Glossary

Companies that rent out infrastructure borrow their words from electrical engineering, networking, operating systems, accounting, telecom regulation and law, and the same word shifts with context: a cell is a fault-isolation copy of a service in a provider's architecture and a set of machines Borg manages as one unit, a plan is a subscription's terms in billing and a proposed set of changes in Terraform, and a zone is a set of buildings in a region and a slice of the DNS namespace. Entries are grouped by the part of the volume that explains them, alphabetized within each group, and each is one line and a link to the chapter that owns the idea; a word with two meanings appears once per meaning, qualified. The volume's own names for the core records (account, project, region and zone, product and SKU, price, plan, subscription, resource, identifier, usage, credit and commitment, quota, hold, invoice and payment, abuse case) are the ones in The Core Data Model.

The Business#

• Abuse case: the record of an abuse report and its mitigations, reusing the user-generated platforms abuse desk tables (moderation_cases, reports, abuse_mitigations) pointed at resources instead of content (The Hosting & Cloud Business).
• Abuse reporters: security researchers, brands, blocklists, mailbox providers, rights holders and other providers, who need a working abuse contact, an acknowledgment and action on evidence (The Hosting & Cloud Business).
• Account: the contracting customer that agrees to the terms, pays and holds standing, and the tenant every row carries; a reseller's customer is an account whose parent is the reseller (The Hosting & Cloud Business).
• Add-ons and upsells: extras sold to existing customers on top of a plan, such as privacy, backups, security scanning, email, dedicated IPs and support tiers (The Hosting & Cloud Business).
• AWS Billing Conductor: the AWS channel partner tool of billing groups, pricing plans, rules and custom line items that produces pro forma cost data with markups or discounts without changing the actual AWS invoice (Accounts, Organizations & Resellers).
• Carriers and their registries: mobile and wireline carriers, The Campaign Registry and the toll-free and short code administrators, who want registered senders and carrier fees per message, and fine traffic that breaks the rules (The Hosting & Cloud Business).
• CAs and root programs: certificate authorities and the browser and operating system vendors that decide which CAs to trust, who require validation to the Baseline Requirements, logged certificates and automated renewals (The Hosting & Cloud Business).
• Ceiling (permissions): a deny-only limit on an organization unit or the account that overrides any allow binding beneath it, since a deny anywhere above wins, the evaluation AWS documents for SCPs (Accounts, Organizations & Resellers).
• Cloudflare tenant: the Cloudflare partner container holding customer accounts and zones, provisioned through the Tenant API, whose tenant admins are Super Administrators of every account inside (Accounts, Organizations & Resellers).
• Colocation and interconnection: the provider segment of data center operators such as Equinix, selling space, power, cross-connects and interconnection to the providers above them (The Provider Landscape).
• Commitments: a spend or usage commitment by a larger customer for one to three years in exchange for a discount, with a shortfall charged if usage falls short (The Hosting & Cloud Business).
• Communications platforms: the provider segment selling numbers, texts, calls and email by the unit, with carrier fees passed through, from CPaaS vendors to email senders (The Provider Landscape).
• Credit and commitment (records): money the customer may draw down (credit_grants) and money it promised to spend (commitments), netted against rated usage at invoice time (The Hosting & Cloud Business).
• Credits and free tiers: promotional, referral and startup credits that draw down usage, paid for by nobody directly because they are a cost of acquisition (The Hosting & Cloud Business).
• Developer clouds: the provider segment (DigitalOcean, Akamai's Linode, Vultr, Hetzner, OVHcloud) selling VMs, managed Kubernetes and databases and object storage at simpler prices than the hyperscalers (The Provider Landscape).
• Edge networks: the provider segment selling caching, TLS, DDoS mitigation, WAF and bot management and edge compute in front of the customer's origin (The Provider Landscape).
• Effective dating: giving every price version, plan version, quota and identifier assignment a closed-open TSTZRANGE, so usage is rated at the price in effect when it happened (The Hosting & Cloud Business).
• End users: the visitors, recipients and callers who reach the customer's site, inbox or phone number, and need pages that load, mail that arrives, texts they asked for and no fraud (The Hosting & Cloud Business).
• European providers: the provider segment (OVHcloud, Hetzner, IONOS, plus the hyperscalers' sovereign offerings) selling dedicated servers, cloud and hosting with EU residency as a selling point (The Provider Landscape).
• Google Cloud billing subaccount: a billing account intended for resellers and paid by a parent billing account on invoiced billing, alongside the Cloud Channel API for distributors, resellers and customer entitlements (Accounts, Organizations & Resellers).
• Hold: a dated restriction on an account (account_holds) for non-payment, abuse, fraud or a sanctions match; standing is the holds in force, and accounts.status is only a cache of them (The Hosting & Cloud Business).
• Hold cascade: the rule that a reseller's non-payment hold applies to every sub-account it bills (cascade_to_sub_accounts), while an abuse hold on one sub-account never reaches the reseller or its other customers (Accounts, Organizations & Resellers).
• Hyperscalers: AWS, Microsoft Azure, Google Cloud and Oracle Cloud Infrastructure, selling every layer from bare metal to managed AI in dozens of regions, metered by the second and the request (The Provider Landscape).
• Identifier: a name or address a resource holds over time (IP, hostname, domain, phone number), held rather than owned, with an exclusion constraint so no two resources hold it at the same instant (The Hosting & Cloud Business).
• Invoice and payment: the Payments volume's invoice, invoice line, payment and ledger tables, linked to accounts, subscriptions and rated usage rather than rebuilt for hosting (The Hosting & Cloud Business).
• ISV under 10DLC: the texting reseller model in which an ISV registers each of its customers as a separate texting brand, ideally through a secondary customer profile and a brand per customer (Accounts, Organizations & Resellers).
• Marketplaces (cloud): provider storefronts where software vendors sell to the provider's customers, paying a listing fee on every sale through the marketplace (The Hosting & Cloud Business).
• Metered usage: per-second, per-request, per-gigabyte or per-message charges rated from usage records, the main way developers and businesses pay clouds and communications platforms (The Hosting & Cloud Business).
• Microsoft Cloud Solution Provider (CSP): Microsoft's partner program in which a direct-bill partner or an indirect reseller buying through a distributor sells licenses and Azure at partner prices, administering through granular delegated admin privileges the customer grants (Accounts, Organizations & Resellers).
• Organization unit: a grouping of scopes (AWS OUs, Azure management groups, Google Cloud folders) used for policy and ceilings, never for payment (Accounts, Organizations & Resellers).
• PaaS and frontend clouds: the provider segment (Vercel, Netlify, Heroku, Render, Fly.io, Railway, Cloudflare Workers) selling deploys from git, functions and managed runtimes, metered on CPU, memory and requests (The Provider Landscape).
• Pass-through fees: money collected from customers for the layer below (registry and ICANN fees per name-year, carrier fees per message, license fees per account), marked as its own SKU so the provider's revenue stays separable (The Hosting & Cloud Business).
• Payer: the party that signs the contract, gets the invoice and holds standing; in this volume the account, which is also the tenant (Accounts, Organizations & Resellers).
• Person or workload: whoever acts on an account: human users through memberships with roles, workloads through service principals with credentials; neither is the account, which outlives every member (Accounts, Organizations & Resellers).
• Plan: a packaged offer of SKUs with included allowances and a term, versioned, and carrying the intro and renewal amounts the customer bought (The Hosting & Cloud Business).
• Plans with included usage: a monthly fee that includes an allowance of usage, then metered overage or a pause once the allowance runs out (The Hosting & Cloud Business).
• Prepaid subscriptions with intro terms: a plan bought for one to four years upfront at an introductory rate that renews at a higher list price, the web host's core model (The Hosting & Cloud Business).
• Price: the price of a SKU in a price book and currency over a period (price_versions); a price change is a new version with notice, never an edit (The Hosting & Cloud Business).
• Product and SKU: what is sold, and each billable unit of it with its meter (The Hosting & Cloud Business).
• Project: a scope inside an account for resources, permissions and quotas: a cloud project or member account, a subscription, a team project or a hosting account (The Hosting & Cloud Business).
• Provider versus underlay: the split that almost every provider resells someone else's layer, as a PaaS runs on a hyperscaler's regions, a host on a cloud, a registrar on a registry and a texting platform on carriers (The Hosting & Cloud Business).
• regions.underlay: the column naming the cloud, colocation operator or customer site a region runs on, so status, incident and residency answers can be generated (The Provider Landscape).
• Registrar reseller: a reseller selling registrations through a registrar's accreditation, usually white-label, under an agreement that must identify the sponsoring registrar, which stays responsible for its conduct (Accounts, Organizations & Resellers).
• Registries and ICANN: the TLD operators and ICANN, which accredits registrars and sets consensus policy, who need their fees per name-year, contract compliance and abuse handling (The Hosting & Cloud Business).
• Resellers and partners: agencies, WHM and registrar resellers, managed service providers, cloud channel partners and ISVs, who need a wholesale price, sub-accounts they control and their own brand on the bill (The Hosting & Cloud Business).
• Resource: anything running or held (a server, VM, cluster, function, database, bucket, site, domain, certificate, phone number), kept in one resources table plus side tables per kind (The Hosting & Cloud Business).
• Scope: the container that holds resources, permissions, quotas and budgets (an AWS member account, an Azure subscription, a Google Cloud project, a cPanel account); in this volume the project (Accounts, Organizations & Resellers).
• Secret scanning partner program: GitHub's program that lets a provider register its token formats and receive a payload when one appears in a public repository, so the provider can revoke or quarantine the leaked key (Accounts, Organizations & Resellers).
• skus.pass_through: the flag marking registry, ICANN, carrier, license, regulatory and marketplace-vendor fees, so the provider's own revenue and margin are separable (The Provider Landscape).
• Subscription: an account's commitment to a plan for a term, renewing, recorded with its periods and whether each was an intro or a renewal term (The Hosting & Cloud Business).
• Subscription versus resource versus usage: the split that matters most in the data model: what the customer agreed to pay for a term, the thing that exists, and what it did, each changing on its own schedule (The Hosting & Cloud Business).
• Underlay suppliers: data center operators, hardware and chip vendors, network carriers, the hyperscaler under a PaaS and software licensors, whose fees are often passed through and whose terms bind the provider (The Hosting & Cloud Business).
• Usage: raw measurements as received (usage_events) and their priced result (rated_usage), kept as two tables so a pricing bug can be fixed by rerating (The Hosting & Cloud Business).
• Usage ingestion: idempotent, append-only intake of meter events, each carrying the producer's idempotency key unique per source, so a replay is a no-op and corrections arrive as new events (The Hosting & Cloud Business).
• Web hosts: the provider segment selling shared, VPS and managed WordPress hosting bundled with domains, email and site builders (The Provider Landscape).
• WHM reseller: a reseller holding a share of a cPanel server with account, disk and bandwidth limits, grouped privileges and its own nameservers, while the server owner ultimately answers for the server and its IPs (Accounts, Organizations & Resellers).
• Who pays versus what runs: the split that one contracting customer pays for many projects, a reseller for many customers it bills itself, and each project holds many resources, so the bill never hangs on the resource (The Hosting & Cloud Business).

Homelab#

• 5G home internet: fixed-wireless service from a cellular carrier to a home gateway, a common backup line that typically sits behind carrier-grade NAT and is deprioritized under congestion (Home Networks: Ethernet, Wi-Fi & Cabling).
• 95th percentile billing: a bandwidth commit where the provider samples traffic every five minutes in each direction, discards the top 5% of samples and bills the higher of ingress and egress at the remaining peak (From Homelab to Colocation).
• Access port: a switch port facing a device that doesn't speak VLANs, where the switch adds the VLAN tag on ingress and strips it on egress (Home Routing, Firewalls & DNS).
• AdGuard Home: a GPL-3.0 DNS sinkhole shipped as one Go binary, with encrypted DNS (DoH, DoT, DNSCrypt) built in, per-client settings and optional DHCP (Home Routing, Firewalls & DNS).
• ArchiveBox: an MIT-licensed personal web archive that saves each URL, bookmark or feed item as HTML, a SingleFile copy, PDF, screenshot, WARC and media, so a cited page outlives its site (Self-Hosted Apps & Orchestration).
• Array (Unraid): Unraid's original storage design, where each data disk keeps its own filesystem and one or two parity disks hold real-time parity across all of them, so mixed disk sizes can join and a read spins up one disk (NAS & Home Storage).
• ashift: the ZFS setting for a device's sector alignment, ashift=12 for 4K-sector disks, fixed when the device first joins a pool and never changeable afterward (NAS & Home Storage).
• ASN (from ARIN): an autonomous system number, which ARIN issues singly to any organization on request, the first step to announcing addresses of one's own over BGP (From Homelab to Colocation).
• AT&T IP Passthrough: the mode AT&T fiber gateways use instead of a full bridge, handing the gateway's WAN address to one device, which loses the gateway's firewall and so must be a real firewall (Home Networks: Ethernet, Wi-Fi & Cabling).
• awesome-selfhosted: the reference catalog of Free Software network services and web applications that can be hosted on one's own servers, with non-free software kept on a separate page (The Homelab).
• AWQ: a 4-bit, weight-only quantization method that protects the weights that matter most to activations, run by vLLM and Transformers (AI at Home).
• Backup class: the homelab's grouping of data (critical, standard, VMs, none) that sets each class's local copy, second machine, offsite copy, retention and restore-test schedule (Self-Hosted Apps & Orchestration).
• Backup line: a low-rate or low-cap internet line kept only for failover, such as a satellite standby plan or a cellular backup, typically behind carrier-grade NAT (From Homelab to Colocation).
• Blended transit: retail colocation bandwidth bought by the provider from several carriers and routed over them, so one carrier's outage is the provider's problem, as opposed to single-carrier transit (From Homelab to Colocation).
• BorgBackup: a BSD-3-Clause deduplicating, encrypting file-level backup program that stores to any remote host reachable over SSH (Self-Hosted Apps & Orchestration).
• bpg/proxmox: the maintained MPL-2.0 Terraform and OpenTofu provider for Proxmox VE, authenticating with an API token and needing SSH to the nodes only for a few operations (Self-Hosted Apps & Orchestration).
• Bridge mode: an ISP gateway setting (Xfinity's Bridge Mode, for example) that turns off the gateway's router and private Wi-Fi and keeps only the modem, so one router of the owner's owns NAT, firewall and the queue (Home Networks: Ethernet, Wi-Fi & Cabling).
• Bufferbloat: latency that climbs under load because a queue forms in the modem or the ISP's equipment, fixed with smart queue management on the home router and measured as latency under load (Home Networks: Ethernet, Wi-Fi & Cabling).
• Cable schedule: a record of every network cable run, labeled at both ends, with its tested result (Home Networks: Ethernet, Wi-Fi & Cabling).
• cake: the CAKE queueing discipline used for SQM on OpenWrt (with piece_of_cake.qos), with cake-autorate adjusting its rate from measured latency on variable links such as LTE, 5G and Starlink (Home Networks: Ethernet, Wi-Fi & Cabling).
• Carrier-grade NAT (CGNAT): an ISP's own NAT in front of customer links numbered from 100.64.0.0/10 (RFC 6598), which stops inbound connections reaching the home whatever the router does (Home Routing, Firewalls & DNS).
• Cat 5e: the cable category rated to 100 MHz that runs gigabit at 100 m and, under 802.3bz, 2.5G and in most cases 5G over the installed base, which makes existing runs worth keeping (Home Networks: Ethernet, Wi-Fi & Cabling).
• Cat 6: the cable category rated to 250 MHz that carries 5G to 100 m but 10GBASE-T only over shorter runs, depending on alien crosstalk (Home Networks: Ethernet, Wi-Fi & Cabling).
• Cat 6A: the cable category rated to 500 MHz and the only one rated for 10GBASE-T at the full 100 m, so the default for new runs (Home Networks: Ethernet, Wi-Fi & Cabling).
• Cat 8: a shielded-only category for short top-of-rack and end-of-row server links with at most two connectors, not a better house cable (Home Networks: Ethernet, Wi-Fi & Cabling).
• Channel model (TIA-568): the cabling rule of a 90 m permanent link of solid cable plus up to 10 m of patch cords, 100 m in all, with stranded cable reserved for cords (Home Networks: Ethernet, Wi-Fi & Cabling).
• Cloudflare Access: Cloudflare's identity check in front of a tunnel's public hostname, where every Access application is deny by default and an Allow policy names the people let in (Exposing Home Services).
• Cloudflare Tunnel: an outbound connection from cloudflared at home to Cloudflare that publishes services without an open inbound port, at the cost that Cloudflare terminates TLS, sees the plaintext and can suspend the hostname under its terms (Exposing Home Services).
• community.proxmox: the Ansible collection that manages Proxmox VMs, instances, storage, firewalls and backups, offers a proxmox inventory plugin and reaches into LXC containers through pct over SSH (Self-Hosted Apps & Orchestration).
• Connector (cloudflared): each running cloudflared process on a Cloudflare Tunnel; several connectors on one tunnel act as replicas, each sending traffic to the nearest Cloudflare data center (Exposing Home Services).
• Consumer mesh: app-managed home Wi-Fi systems (eero, TP-Link Deco, Netgear Orbi, ASUS) whose nodes link over wireless backhaul, with feature sets that vary by model and sometimes depend on a subscription (Home Networks: Ethernet, Wi-Fi & Cabling).
• Copper-clad aluminum (CCA): network cable with aluminum conductors coated in copper, which fails the NEC and UL requirement for copper conductors in communications cable and should never be installed (Home Networks: Ethernet, Wi-Fi & Cabling).
• Corosync: the Proxmox VE cluster stack, which needs low, steady latency between nodes rather than bandwidth, ideally on a dedicated link, because storage or backup traffic on the same link can break quorum (Hypervisors at Home).
• Data caps: monthly transfer limits on residential internet plans, fading on new plans but still applied to some legacy ones with overage charges (From Homelab to Colocation).
• Dataset (ZFS): a filesystem inside a ZFS pool with its own properties (compression, record size, quota, encryption) and its own snapshots, ideally one per app so snapshots and restores are per app (NAS & Home Storage).
• DERP: Tailscale's relay servers, used as the last resort when hard NAT or firewalls prevent a direct path; relayed traffic stays end-to-end encrypted and a DERP server can't decrypt it (Exposing Home Services).
• DevDocs: an MPL-2.0 documentation browser with an offline mode that downloads documentation sets into the browser, also published as a self-hosted image (Self-Hosted Apps & Orchestration).
• DGX Spark: NVIDIA's small unified-memory AI machine with 128 GB of LPDDR5X, high in capacity but low in bandwidth next to a discrete GPU, suited to large mixture-of-experts models; several units can be clustered (AI at Home).
• Distribution (registry): the CNCF project that was Docker Registry, the minimal choice for a LAN container registry so images built at home are not pulled across the uplink on every deploy (From Homelab to Colocation).
• DIY tower: a self-assembled server from consumer parts, often with an iGPU and an HBA for more drives, with IPMI only on server-class boards, typically used as NAS plus apps plus transcoding (The Homelab).
• Docker Compose: the Apache-2.0 Docker CLI plugin (docker compose) that runs multi-container apps from YAML, the portable, diffable app runtime for a homelab when kept in Git (Self-Hosted Apps & Orchestration).
• DOCSIS: the cable internet standard, where DOCSIS 3.1 modems offer far more download than upload and DOCSIS 4.0 raises upstream through Full Duplex or Extended Spectrum DOCSIS; deployed plans offer far less than the specification (From Homelab to Colocation).
• DuckDNS: a free, donation-funded dynamic DNS service whose client calls an update URL with a token; it uses the caller's address but cannot detect IPv6, which has to be passed explicitly (Exposing Home Services).
• Dynamic DNS (DDNS): a service that updates a hostname whenever a residential IPv4 address changes, the name half of a port forward (Exposing Home Services).
• eero Internet Backup: eero's failover to a phone hotspot or another Wi-Fi network, offered to eero Plus subscribers and select ISP customers rather than every owner (Home Networks: Ethernet, Wi-Fi & Cabling).
• Emby: a media server, proprietary since version 4, that sells features through its Emby Premiere subscription (Self-Hosted Apps & Orchestration).
• EXL2 / EXL3: ExLlama's quantization formats, mixing precision per layer to hit any average bits per weight between 2 and 8 (AI at Home).
• ExLlamaV2 / ExLlamaV3: MIT-licensed NVIDIA CUDA runtimes built for fast single-user inference on consumer cards; V3 adds tensor and expert parallelism across GPUs, and V2 is archived in favor of V3 (AI at Home).
• Exposure class: the homelab inventory field (none, lan, proxy-allowlist, public) recording how each service is reached, who authenticates it and how fast it is patched (Exposing Home Services).
• Flent: an on-demand network load-testing tool whose RRUL test measures latency while saturating the line, used with IRTT for precise round-trip times (Home Networks: Ethernet, Wi-Fi & Cabling).
• FLUX.1: a 12B image model family whose [dev] weights are non-commercial (outputs usable commercially) and whose [schnell] variant is Apache 2.0 (AI at Home).
• Forwardings (OpenWrt): OpenWrt firewall entries that permit traffic from one zone to another in one direction only (Home Routing, Firewalls & DNS).
• FP8: an 8-bit floating-point format (E4M3, E5M2) for Hopper and newer GPUs and RTX 40 and 50 cards, which large evaluations found effectively lossless across model scales (AI at Home).
• Funnel (Tailscale): the exception to Tailscale's private-only model, routing public internet traffic to a tailnet device on a few fixed ports under non-configurable bandwidth limits, in beta (Exposing Home Services).
• Gateway group: the pfSense and OPNsense dual-WAN construct that groups WAN gateways into tiers, where gateways on one tier load-balance and gateways on different tiers fail over, selected by a LAN rule (From Homelab to Colocation).
• GGUF K-quants and I-quants: llama.cpp's quantization formats from about 2 to 8.5 bits per weight, run by every llama.cpp backend, Ollama and LM Studio, with an importance matrix from calibration text reducing loss (AI at Home).
• Gitea Actions: Gitea's built-in CI with GitHub-style workflow syntax and act_runner as its agent, so a forge and its CI can both live on the LAN (From Homelab to Colocation).
• gpt-oss: OpenAI's Apache 2.0 open-weight mixture-of-experts models, shipped in MXFP4, whose half-windowed attention layers cut memory, so the larger runs on a single 80 GB GPU (AI at Home).
• GPTQ: a second-order post-training quantization method at 3 to 4 bits, weight-only, run by vLLM and Transformers (AI at Home).
• Grants (Tailscale): the entries in a tailnet policy file that say which sources may reach which destinations and ports, alongside groups, tagOwners and tests that fail a change breaking an expected path (Exposing Home Services).
• Grouped-query attention: a model design where many query heads share a few key-value heads, which is what makes the KV cache affordable at long context (AI at Home).
• Harvester: SUSE's open-source hypervisor built on Kubernetes with KubeVirt and Longhorn, running VMs through Kubernetes (Hypervisors at Home).
• Headscale: a self-hosted control plane for Tailscale clients, giving the same traffic path as Tailscale while the owner runs and patches the control plane (Exposing Home Services).
• Home Assistant: the Apache-2.0 home automation platform funded by Nabu Casa's subscribers, installed either as Home Assistant OS, the recommended embedded operating system, or as Home Assistant Container, where the owner handles updates and apps are unsupported (Self-Hosted Apps & Orchestration).
• home.arpa: the domain reserved by RFC 8375 for names that exist only inside a house, used instead of an invented TLD that leaks to the root (Home Routing, Firewalls & DNS).
• Hybrid Mesh Backup (TP-Link Deco): Deco's failover in which a 4G/5G Deco with an active SIM backs up the whole network and switches back automatically when the main line returns (Home Networks: Ethernet, Wi-Fi & Cabling).
• Hyper-V: Microsoft's hypervisor, a feature of Windows Pro and Enterprise and Windows Server; the free standalone Hyper-V Server ended with its 2019 release (Hypervisors at Home).
• Immich: an AGPL-3.0 self-hosted photo and video service, shipped as a Compose stack, whose core team is employed by FUTO and which sells an optional key while promising never to paywall features (Self-Hosted Apps & Orchestration).
• Incus: the community-led fork of LXD from the Linux Containers project, managing system containers and VMs with LXC and QEMU under Apache-2.0 (Hypervisors at Home).
• Ingress rules (cloudflared): the ordered list in a locally managed tunnel's config.yml mapping hostname and optional path to a local service, which must end with a catch-all rule (Exposing Home Services).
• Inter-VLAN rules: the firewall rules between home segments, default deny with exceptions only for the flows a household actually uses, without which segmentation means nothing (Home Routing, Firewalls & DNS).
• Internet-in-a-Box: an installable bundle of the offline internet: Kiwix, OER2Go and Archive.org content packs, learning videos and education apps such as Kolibri, Moodle and Nextcloud (Self-Hosted Apps & Orchestration).
• IOMMU: the CPU and board feature (Intel VT-d or AMD-Vi), enabled in firmware, that PCIe passthrough requires to give a VM direct control of a device (Hypervisors at Home).
• IOMMU groups: the units in which the IOMMU isolates devices; only a whole group can be passed through, and grouping depends on the board's PCIe layout and ACS support, so it is checked before buying a board (Hypervisors at Home).
• IPv6 prefix delegation: the RFC 7084 behavior where a home router requests a prefix from the ISP with DHCPv6 (IA_PD), sized for a /64 on each of its interfaces (Home Routing, Firewalls & DNS).
• ISP-supplied gateway: the ISP's combined modem, router and Wi-Fi box, whose firmware, queueing and Wi-Fi placement stay under the ISP's control, which is why bridge mode or IP Passthrough matters (Home Networks: Ethernet, Wi-Fi & Cabling).
• Jellyfin: a GPL-2.0 volunteer media server with no premium licenses or features, trading paywalls for volunteer capacity (Self-Hosted Apps & Orchestration).
• Kiwix: a nonprofit that packages websites such as Wikipedia as ZIM files, highly compressed archives readable in its apps or served on a network by kiwix-serve (Self-Hosted Apps & Orchestration).
• kiwix-serve: Kiwix's GPLv3 HTTP daemon that serves ZIM files on a network, also shipped as a container image (Self-Hosted Apps & Orchestration).
• Kokoro-82M: an Apache 2.0 text-to-speech model with 82M parameters (AI at Home).
• KV cache: the key and value vectors a model stores per layer for every token in context, sized at 2 x layers x KV heads x head dimension x bytes per element per token, the hidden variable in memory sizing (AI at Home).
• KVM with libvirt: the Linux kernel hypervisor managed through libvirt on any Linux host, the base that won the home tier (Hypervisors at Home).
• LibreNMS: an SNMP monitoring system for switches, access points and router interfaces (Home Networks: Ethernet, Wi-Fi & Cabling).
• llama.cpp: the MIT-licensed GGUF runtime for CPU, CUDA, Metal, Vulkan, ROCm and SYCL, whose llama-server offers partial GPU offload and an OpenAI-compatible API (AI at Home).
• LM Studio: a desktop app for running GGUF and, on Apple Silicon, MLX models, free for work use, with a headless daemon and OpenAI-style endpoints (AI at Home).
• Local zones (Unbound): Unbound's local DNS records, where a static zone answers only from local data and returns NXDOMAIN for anything else, and a redirect zone answers every name under it with one record (Home Routing, Firewalls & DNS).
• LXC: Linux system containers, as run in Proxmox VE, that share the host kernel, are unprivileged by default, start in seconds and suit a single Linux service; a VM is needed for another kernel (Hypervisors at Home).
• LXD: the Linux Containers project's manager for system containers and VMs until Canonical took it in house, which led to the Incus fork (Hypervisors at Home).
• mergerfs: a FUSE union filesystem that presents many disks' paths as one mount with policies for where new files go, explicitly without redundancy, usually paired with SnapRAID (NAS & Home Storage).
• Mesh (Wi-Fi): access points linked to each other over radio, where every wireless hop spends airtime twice, which is why wired backhaul beats it (Home Networks: Ethernet, Wi-Fi & Cabling).
• Mini PC: low-power x86 boxes and 1-liter business desktops (N100 boxes, HP Elite Mini, Lenovo Tiny, Dell Micro), quiet and cheap to run but limited in memory and drives, the default for always-on services (The Homelab).
• Minimum routable prefix: the smallest block the internet will carry, a /24 of IPv4 or a /48 of IPv6, because smaller subnets are filtered (From Homelab to Colocation).
• MLX: Apple's MIT-licensed array framework for Apple Silicon's unified memory, whose mlx-lm runs language models and whose models LM Studio can serve (AI at Home).
• MoCA: Ethernet over existing coax, which turns a cable TV outlet into wired backhaul for an access point (Home Networks: Ethernet, Wi-Fi & Cabling).
• Modified MIT License: a model license label used by some open-weight releases that adds conditions to MIT, ranging from a name display requirement to barring large companies outright, so the license file must be read, not the tag (AI at Home).
• Mover (Unraid): the Unraid job that migrates files from a fast pool to the array on a schedule, according to each share's primary and secondary locations (NAS & Home Storage).
• MXFP4: the OCP microscaling 4-bit format (E2M1 with one power-of-two scale per 32 values) that gpt-oss ships in, accelerated on Blackwell (AI at Home).
• NAS appliance: a storage box from Synology, QNAP, TerraMaster or UGREEN that hides its operating system behind a vendor web UI, low-effort storage subject to the vendor's drive policy and OS lifecycle (The Homelab).
• Network UPS Tools (NUT): GPL software that supports UPSes and power devices through one protocol; upsd serves a UPS's state and upsmon on each host shuts secondaries down first and the attached primary last (The Homelab).
• Nextcloud: an AGPL-3.0 platform for file sync, sharing, office and calendars, with a paid Enterprise edition per user (Self-Hosted Apps & Orchestration).
• Nginx Proxy Manager: nginx with a web UI in a Docker image, with proxy hosts and built-in Let's Encrypt, whose configuration lives in its database rather than in Git (Exposing Home Services).
• No-IP: a dynamic DNS provider whose free plan gives one hostname on its own domains, with custom domains on a paid plan (Exposing Home Services).
• NVFP4: NVIDIA's 4-bit format (E2M1 with an FP8 scale per 16 values, about 4.5 bits) for Blackwell Tensor Cores, including RTX 50 cards (AI at Home).
• Ollama: an MIT-licensed model server that manages loading and unloading GGUF models from its own registry, with a native API and an OpenAI-compatible /v1, sizing its default context by VRAM (AI at Home).
• Open WebUI: the common front end for local models, with chats, knowledge bases, web search, speech, image generation, Python tools and MCP, against Ollama or any OpenAI-compatible API (AI at Home).
• OpenWrt: open-source replacement firmware for consumer routers on Linux and nftables (fw4), whose firewall groups interfaces into zones with forwardings between them (Home Routing, Firewalls & DNS).
• OpenZFS: the CDDL-licensed ZFS project, run on a general OS such as Debian, Proxmox VE or FreeBSD, free but with all management by hand and the module out of tree (NAS & Home Storage).
• OPNsense: a BSD 2-clause router and firewall distribution on FreeBSD's pf, forked from pfSense, with Unbound blocklists and WireGuard built in (Home Routing, Firewalls & DNS).
• Optic coding: vendor fields in a transceiver's EEPROM that some enterprise switches read to refuse optics they don't recognize, the source of SFP lock-in (Home Networks: Ethernet, Wi-Fi & Cabling).
• Organic Maps: an Apache 2.0 phone map app built on OpenStreetMap data that supports every feature without an internet connection (Self-Hosted Apps & Orchestration).
• OsmAnd: a phone map app with fully offline maps of any region and offline navigation, built on OpenStreetMap data (Self-Hosted Apps & Orchestration).
• Parity array versus pool: the main split in home storage: independent disks with parity beside them grow one disk at a time and lose only failed disks, while striped pools are faster and checksummed but grow in fixed shapes (NAS & Home Storage).
• Path diversity: using backup links of a different type over different cable paths, because links from the same provider tend to fail together (From Homelab to Colocation).
• Peer (WireGuard): a key pair and a list of Allowed IPs, with no session negotiation and nothing that answers an unauthenticated packet; keys are distributed by hand (Exposing Home Services).
• pfSense CE: Netgate's free Apache-2.0 router and firewall distribution on FreeBSD's pf, descended from m0n0wall, with most development effort now going to pfSense Plus (Home Routing, Firewalls & DNS).
• pfSense Plus: Netgate's proprietary productized build of pfSense, included on Netgate appliances and sold per instance elsewhere (Home Routing, Firewalls & DNS).
• Pi-hole: an open-source DNS sinkhole on dnsmasq (FTL) that blocks ads and trackers for the house, with optional DHCP; run as a pair, because a single resolver is the classic outage (Home Routing, Firewalls & DNS).
• Plex Media Server: a proprietary media server with polished clients on almost every TV and console, which charges remote viewers through Plex Pass and a Remote Watch Pass (Self-Hosted Apps & Orchestration).
• PMTiles: Protomaps' single-file archive format for tiled map data, read by clients with HTTP range requests so a static file server serves a map with no tile server (Self-Hosted Apps & Orchestration).
• PoE budget: the total class power a switch must supply, summed from each access point's and camera's PoE class rather than its typical draw (Home Networks: Ethernet, Wi-Fi & Cabling).
• Pool (Unraid): Btrfs or ZFS storage beside the Unraid array for cache, VMs and containers, recommended for all-flash servers (NAS & Home Storage).
• Pool (ZFS): ZFS's combined volume manager and filesystem, built from vdevs that writes stripe across, so losing any vdev loses the pool (NAS & Home Storage).
• Port forward plus DDNS: the inbound method of exposing a home service, sending internet traffic straight to the home's public IP, reachable by anyone and unusable behind CGNAT (Exposing Home Services).
• Portainer: a container management UI shipped as a container image, with a Zlib Community Edition and a paid Business Edition (Self-Hosted Apps & Orchestration).
• Powerline: adapters (HomePlug AV2, G.hn) that carry Ethernet over electrical wiring, the last resort before mesh, with throughput that depends on the circuit (Home Networks: Ethernet, Wi-Fi & Cabling).
• Prometheus blackbox_exporter: an Apache-2.0 exporter that turns ICMP, HTTP, DNS and TCP probes into metrics for Grafana and alerting (Home Networks: Ethernet, Wi-Fi & Cabling).
• Prosumer, controller-managed networking: UniFi, OpenWrt or a pfSense or OPNsense box with standalone access points, giving VLANs, SQM, multi-WAN, per-port PoE and monitoring, where the owner's configuration is the risk (Home Networks: Ethernet, Wi-Fi & Cabling).
• Proxmox Backup Server (PBS): Proxmox's AGPLv3 backup server, written in Rust, that takes incremental, server-deduplicated, client-encrypted backups of VMs, containers and hosts and syncs to a remote PBS (Hypervisors at Home).
• Proxmox Datacenter Manager: an AGPLv3 single view across several Proxmox VE clusters, nodes and PBS instances, with cross-cluster live migration, which a one-cluster homelab doesn't need (Hypervisors at Home).
• Proxmox VE: the Debian-based hypervisor with KVM/QEMU and LXC, every feature free and a subscription buying only the enterprise update repository and support, the homelab default (Hypervisors at Home).
• Proxmox VE repositories: the update channels (pve-enterprise for subscribers, and the free no-subscription repository that receives updates first), which are what a subscription sells instead of features (Hypervisors at Home).
• QAT checkpoint: a model checkpoint trained for low precision (quantization-aware training), usually 4-bit, instead of rounded after training (AI at Home).
• QDevice: an external third vote for a two-node Proxmox cluster, corosync-qnetd on an independent machine with corosync-qdevice on each node, discouraged on clusters with an odd node count (Hypervisors at Home).
• QTS: QNAP's NAS operating system on ext4 over classic RAID (NAS & Home Storage).
• Quorum (cluster): the vote count a cluster needs to change configuration; high availability needs at least three votes, from three nodes or two plus a QDevice, and a node out of quorum refuses changes (Hypervisors at Home).
• QuTS hero: QNAP's ZFS-based NAS operating system with self-healing, inline deduplication and compression, and triple-parity and triple-mirror layouts (NAS & Home Storage).
• r/homelab: the Reddit community about home hardware, racks, networking and the lab itself, one of the hobby's two public squares (The Homelab).
• r/selfhosted: the Reddit community about the software people run on their own hardware (The Homelab).
• RAIDZ: a ZFS vdev with single, double or triple parity (RAIDZ1, RAIDZ2, RAIDZ3) tolerating one, two or three device failures, the alternative to a mirror (NAS & Home Storage).
• RAIDZ expansion: the OpenZFS feature (zpool attach to a RAIDZ vdev) that widens an existing RAIDZ vdev by one disk, where before a home user had to add a whole vdev or replace every disk (NAS & Home Storage).
• Repatriation in miniature: the homelab as a swap of metered rent for a fixed cost of hardware, electricity and the owner's hours, the same calculation companies make leaving the cloud (The Homelab).
• Residential cable or fiber: home internet sold in download-weighted speed tiers with dynamic public IPv4 and an AUP that limits use to personal, non-commercial purposes, unlike business plans with static blocks (From Homelab to Colocation).
• restic: a BSD-2-Clause deduplicating, encrypting file-level backup program that writes to local disks, SFTP, its REST server, S3-compatible storage and other clouds (Self-Hosted Apps & Orchestration).
• Ride-through: keeping a lab running through a long power outage, which takes a home battery or generator; a UPS only buys a clean shutdown (From Homelab to Colocation).
• Sanoid and syncoid: a GPL-3.0 policy-driven ZFS snapshot manager and its companion that replicates datasets over SSH with incremental zfs send (NAS & Home Storage).
• Scrub (ZFS): a scheduled read of every block in a pool that finds and repairs silent corruption from redundancy before a second failure makes it unrecoverable (NAS & Home Storage).
• SGLang: an Apache 2.0 GPU model server with the RadixAttention prefix cache and structured generation behind an OpenAI-compatible API (AI at Home).
• Smart queue management (SQM): shaping traffic slightly below the ISP's rate so the queue forms in the home router, where a fair-queueing AQM such as CAKE or FQ_CoDel manages it, the fix for bufferbloat (Home Networks: Ethernet, Wi-Fi & Cabling).
• SMART self-test: a drive's own short or long self-test; rising reallocated or pending sectors or a failed test mean ordering or fitting a replacement (NAS & Home Storage).
• SmokePing: a tool that graphs latency and loss distribution over time to many targets, the classic "smoke" graph (Home Networks: Ethernet, Wi-Fi & Cabling).
• SnapRAID: GPL-3.0 parity computed only on request (snapraid sync) over disks that each keep an ordinary filesystem, with scrubs against checksums; new files stay unprotected until the next sync (NAS & Home Storage).
• Snapshot (ZFS): an instant copy-on-write point-in-time view of a dataset, which zfs send turns into a stream, whole or incremental, that another pool can receive (NAS & Home Storage).
• Special, log and cache vdevs: ZFS support devices that change performance, not redundancy: a special vdev holds metadata (and is part of the pool, so needs full redundancy), a log device absorbs synchronous writes, and a cache device is a second-level read cache (NAS & Home Storage).
• Stable Diffusion: Stability AI's image model family, whose licenses run from CreativeML OpenRAIL-M on 1.x to the Stability AI Community License on 3.5, which ends above a revenue threshold (AI at Home).
• Starlink Standby Mode: a low-cost Starlink plan with unlimited data at a low speed, kept as a backup line, which may not reactivate to a full plan in a congested cell (Home Networks: Ethernet, Wi-Fi & Cabling).
• Strix Halo: AMD's Ryzen AI Max+ unified-memory platform, letting much of its memory serve as graphics memory for large models at a fraction of a discrete GPU's bandwidth (AI at Home).
• Subnet router (Tailscale): a tailnet node that advertises a LAN prefix, putting a whole VLAN on the tailnet without a client on each device (Exposing Home Services).
• Synology drive policy: Synology's policy on its 2025 Plus models that drives not Synology-branded or certified lost storage pool creation, health monitoring and firmware updates, the risk of a vendor selling the whole box (NAS & Home Storage).
• Synology DSM: Synology's proprietary NAS operating system, Btrfs volumes on Synology Hybrid RAID (SHR) or classic RAID, sold with the hardware (NAS & Home Storage).
• Tailscale: a WireGuard overlay with a hosted control plane that distributes keys and handles NAT traversal so devices connect directly, falling back to DERP relays, reachable only by tailnet members (Exposing Home Services).
• Telmate/proxmox: the older MIT-licensed Terraform provider for Proxmox that provisions QEMU VMs and LXC containers, with known limitations listed in its README (Self-Hosted Apps & Orchestration).
• tileserver-gl: a server that serves vector tiles from MBTiles files to MapLibre GL JS, Leaflet and OpenLayers, with optional server-side raster rendering (Self-Hosted Apps & Orchestration).
• Traefik: a reverse proxy that reads routes from Docker labels; its Docker provider routes every container by default unless exposedByDefault is set to false (Exposing Home Services).
• TrueNAS CORE: iXsystems' open-source ZFS NAS on FreeBSD, the renamed FreeNAS, now at its final release (NAS & Home Storage).
• TrueNAS SCALE (Community Edition): iXsystems' ZFS NAS on Debian Linux with Linux containers and KVM, now TrueNAS Community Edition, whose apps moved from Kubernetes (k3s) to Docker (NAS & Home Storage).
• Trunk port: a switch link carrying several tagged VLANs, such as the firewall-to-switch link or the link to an access point that maps each SSID to a VLAN (Home Routing, Firewalls & DNS).
• Unbound: the DNS resolver built into the firewall distributions, which can answer local names and block ads with DNSBL lists (OPNsense) or pfBlockerNG (pfSense) without a separate box (Home Routing, Firewalls & DNS).
• UniFi: Ubiquiti's proprietary gateway, switch, access point and camera line under one controller, sold at the hardware price with the controller given away (Home Routing, Firewalls & DNS).
• Unified memory: a design where CPU and GPU share one large memory pool (DGX Spark, Strix Halo, Apple Silicon), trading discrete-GPU bandwidth for the capacity to load very large models (AI at Home).
• Unraid: Lime Technology's proprietary NAS OS, a parity array of independent disks plus Btrfs or ZFS pools, licensed in Starter, Unleashed and Lifetime tiers (NAS & Home Storage).
• Unraid Community Applications: the community-maintained plugin catalog of Docker templates and plugins for Unraid (Self-Hosted Apps & Orchestration).
• Unraid license tiers: Starter (a limited number of storage devices), Unleashed (unlimited) and Lifetime; Starter and Unleashed include a year of updates, then an optional paid extension (NAS & Home Storage).
• UPnP: a port mapping protocol that lets a device open the firewall without asking, which a homelab turns off (Home Routing, Firewalls & DNS).
• UPS: an uninterruptible power supply, which rides out flickers and buys time for a clean shutdown but doesn't carry a lab through a long outage; size it on watts, not volt-amperes (The Homelab).
• Uptime Kuma: an MIT-licensed self-hosted monitor for HTTP, ping, DNS and port checks with notifications (Home Networks: Ethernet, Wi-Fi & Cabling).
• Used enterprise server: a retired data center rack server, cheap to buy and high in capacity and out-of-band management, but loud, deep and expensive in idle power (The Homelab).
• Vaultwarden: an AGPL-3.0 volunteer server compatible with the official Bitwarden clients, unofficial and not associated with Bitwarden, kept off tunnels and public exposure (Self-Hosted Apps & Orchestration).
• vdev: the building block of a ZFS pool, either a mirror (N disks with identical copies, surviving N-1 failures) or a RAIDZ group (NAS & Home Storage).
• vfio-pci: the Linux driver a device is bound to by ID for passthrough, so the host doesn't claim it, as an alternative to blacklisting its normal driver (Hypervisors at Home).
• vLLM: an Apache 2.0 model server for many GPU and CPU types, using PagedAttention and continuous batching behind an OpenAI-compatible server (AI at Home).
• VMware ESXi (free): Broadcom's free vSphere Hypervisor 8, non-production only, with no vCenter, no support and no HA or vMotion, useful only for learning the host (Hypervisors at Home).
• VPS relay: exposing a home service through a rented VPS that takes internet traffic and tunnels it home, working behind CGNAT at the cost of another internet-facing box (Exposing Home Services).
• Waveform bufferbloat test: a test that grades the latency increase under load over unloaded latency from A+ to F, used to verify SQM (Home Networks: Ethernet, Wi-Fi & Cabling).
• Whisper: OpenAI's speech-to-text models, with code and weights released under MIT (AI at Home).
• WireGuard: a layer 3 secure networking tunnel in mainline Linux, configured as peers of key pairs, and the protocol under Tailscale, Headscale and plain router VPNs (Exposing Home Services).
• XCP-ng: the Xen-based hypervisor project backed by Vates, every feature free, managed with Xen Orchestra (Hypervisors at Home).
• Xen Orchestra: the management layer for pools of XCP-ng hosts (VM lifecycle, backups, replication and HA), sold as the XOA appliance or built free from source (Hypervisors at Home).
• XO Lite: a lightweight Xen Orchestra embedded in an XCP-ng host's own web page (Hypervisors at Home).
• Zeal: an offline documentation browser for Windows and Linux using Dash's docsets (Self-Hosted Apps & Orchestration).
• ZFS replication: sending snapshots between local pools on a schedule so a VM can restart on another node, losing whatever changed since the last run (Hypervisors at Home).
• ZIM file: Kiwix's highly compressed archive of web content; Wikipedia ships as maxi (full), nopic (no images) and mini (introductions and infoboxes) (Self-Hosted Apps & Orchestration).
• Zones (OpenWrt): groups of interfaces in OpenWrt's firewall, each with input, output and forward policies, connected by one-way forwardings (Home Routing, Firewalls & DNS).

The Stack, Bottom to Top#

• A and B feeds: paired power circuits to a cabinet on separate feeds so one can fail; redundancy holds only if either feed can carry the whole cabinet and the server uses both (The Data Center & Colocation).
• Accrual limit (CPU credits): the cap on banked CPU credits for a burstable instance, a day's earnings, above which new credits are discarded (Virtualization & the VPS).
• AI fabric: the second, separate network in a GPU building that connects accelerators for training jobs that stall if one packet is late, built from InfiniBand or from Ethernet tuned to behave like it (Data Center Networking).
• AI Zone: Meta's unit of AI cluster, a two-stage Clos of rack switches with shallow buffers and cluster switches with deep buffers, joined across a building by an aggregation layer oversubscribed by design (Data Center Networking).
• Alloc: in Borg, a reservation of resources on one machine that one or more tasks share (Schedulers: Borg to Kubernetes).
• Amazon ECS: AWS's container scheduler, placing tasks on the customer's own EC2 instances or on Fargate through requirements, constraints and best-effort strategies (binpack, spread, random) (Schedulers: Borg to Kubernetes).
• Andromeda: Google's software-defined network under its cloud's firewalls, routing and load balancing, with a host fast path in software so live migration works across different NICs (Data Center Networking).
• Applied quota: in AWS Service Quotas, the override that replaces a quota's default value after an increase request is approved (Regions, Zones, Cells & Quotas).
• Asynchronous geo-replication: copying storage to a second region after the write is acknowledged, so data not yet replicated is lost in a regional disaster, up to the replication lag (Storage: Block, File & Object).
• AWS European Sovereign Cloud: AWS's European partition with its own region, run under a separate parent company with German subsidiaries led by EU citizens (Hybrid & On-Prem Cloud).
• AWS Fargate: AWS's serverless container service, where the customer brings images and task definitions and each task gets its own isolation boundary, sharing no kernel with another task (From chroot to Containers).
• AWS Lambda: AWS's regional functions product, each environment a Firecracker microVM slot, billed by requests and memory multiplied by duration (Functions, Isolates & Edge Compute).
• AWS Outposts: AWS-owned racks or servers installed in the customer's building and maintained by AWS, connected to a parent Region by a service link and priced per configuration for a term (Hybrid & On-Prem Cloud).
• Azure Arc: Microsoft's control plane that projects servers, VMs, Kubernetes clusters and SQL Server outside Azure into Azure Resource Manager, governing them without running them (Hybrid & On-Prem Cloud).
• Azure Container Instances: Azure's serverless containers, an image and a container group isolated at the hypervisor level, with confidential containers in a hardware trusted execution environment (From chroot to Containers).
• Azure Functions Flex Consumption: Azure's current functions plan, billed on executions and GB-seconds while executing, with per-instance concurrency and optional always-ready instances (Functions, Isolates & Edge Compute).
• Azure Local: Microsoft's software for customer-owned validated hardware (formerly Azure Stack HCI), with Azure Arc as the control plane and a host fee per physical core (Hybrid & On-Prem Cloud).
• Azure Stack Hub: integrated partner systems run by the customer's own operator, who sells plans and offers to tenants, able to run connected or fully disconnected (Hybrid & On-Prem Cloud).
• Backblaze B2: an S3-compatible object store priced per TB-month with free egress up to a multiple of stored data and no minimum duration or object size (Storage: Block, File & Object).
• Balloon driver: a driver inside a guest that the hypervisor inflates to make the guest's own allocator free memory, so the guest chooses what to page out (Virtualization & the VPS).
• Baseboard management controller (BMC): a small computer on the motherboard with its own network port, powered whenever the chassis is, that can power the server on and off, read sensors, set the boot device and give a console; its network is the most sensitive the provider runs (Dedicated Servers & Bare Metal).
• Baseline (CPU credits): the utilization at which a burstable instance earns credits as fast as it spends them, its earn rate per vCPU spread over an hour (Virtualization & the VPS).
• Bati Courtage v. OVH: a French commercial court ruling against OVH over a backup option described as physically isolated from the VPS infrastructure that was not (Storage: Block, File & Object).
• Block volume: a virtual disk the customer's operating system formats and mounts, promised to survive a disk or server failure inside one zone and dying with the zone (Storage: Block, File & Object).
• Bluepad v. OVH: a French commercial court ruling that the stated location of servers and backups is contractual, rejecting OVH's force majeure defense (Storage: Block, File & Object).
• Borg: Google's internal cluster scheduler, whose published design (cells, jobs, tasks, allocs, priority and quota) is the vocabulary every later scheduler used (Schedulers: Borg to Kubernetes).
• Borglet: the Borg agent on every machine that starts and stops tasks and reports state when polled (Schedulers: Borg to Kubernetes).
• Borgmaster: Borg's central controller, logically one process but replicated five times with state in a Paxos-based store (Schedulers: Borg to Kubernetes).
• Bucket, object and key: the nouns of an object store, a flat namespace of buckets holding objects under keys, read and written whole over HTTP (Storage: Block, File & Object).
• Burn-in: tests that new and repaired machines run in the in-memory environment before they enter the available pool (Dedicated Servers & Bare Metal).
• Burst window: a CPU-sharing model (Google E2 shared-core) that allows a short burst at full speed periodically, at no extra charge, instead of a credit bank (Virtualization & the VPS).
• Cabinet: a lockable rack enclosure in a shared colocation room with power circuits to it, sold whole, by fraction or by single rack unit (The Data Center & Colocation).
• Cage: a fenced colocation area of several cabinets built to order for a single customer (The Data Center & Colocation).
• CageFS: CloudLinux's per-user filesystem view built from a template, giving each account its own /etc and /tmp and a restricted /proc so it can't see the server or other accounts (Shared Hosting Isolation).
• Capabilities (Linux): root's powers split into units such as CAP_NET_ADMIN and CAP_SYS_ADMIN; a provider drops most by default, and a privileged container gets them all and is effectively the host (From chroot to Containers).
• Capacity reservation: a product that guarantees capacity of an instance type in a zone without a discount, billed at the on-demand rate whether used or not; capacity is not quota (Regions, Zones, Cells & Quotas).
• CDN functions: small functions on a CDN's request path (CloudFront Functions, Lambda@Edge) with tight limits and a per-invocation price (Functions, Isolates & Edge Compute).
• Cell (architecture): a complete copy of a service that serves only some customers, so a bad deploy or a poison request reaches a fraction of them (Regions, Zones, Cells & Quotas).
• Cell (Borg): a set of machines managed by Borg as one unit (Schedulers: Borg to Kubernetes).
• Cell router: the thinnest possible layer in a cell architecture, routing each request to the right cell by its partition key and doing nothing else (Regions, Zones, Cells & Quotas).
• Ceph: a self-hosted storage system, a RADOS cluster with CRUSH placement serving a file system and an S3 and Swift gateway, where the operator owns durability (Storage: Block, File & Object).
• Cloud Hypervisor: a general-purpose Rust VMM under the Linux Foundation with more devices (including PCI passthrough) and guests than Firecracker, used in Kata deployments (Sandboxes & MicroVMs).
• Cloudflare Containers: containers started on demand from a Worker through a Durable Object, each instance in a Firecracker microVM with its own kernel and network (From chroot to Containers).
• Cloudflare R2: Cloudflare's S3-compatible object store with free egress, whose documentation lists the S3 features it doesn't implement (Storage: Block, File & Object).
• Cloudflare Workers: Cloudflare's edge functions in V8 isolates, many tenants per process, billed by requests and CPU time with no charge for duration (Functions, Isolates & Edge Compute).
• CloudFront Functions: AWS's lightweight CDN functions for request-path work such as header rewrites, with tiny memory and code limits and a price per invocation (Functions, Isolates & Edge Compute).
• CloudLinux OS: a hosting operating system that gives each account an LVE of kernel resource limits, with CageFS, PHP Selector, mod_lsapi PRO and MySQL Governor, turning noisy neighbors into per-account limits with fault counters (Shared Hosting Isolation).
• Cold start: the INIT phase of a function plus the time to get a slot, of which the provider controls only the second half (Functions, Isolates & Edge Compute).
• Collisions (ECMP): ECMP's failure mode, where hashing places two large flows on the same uplink so each gets half of it while other links sit idle, the problem AI training traffic exposes (Data Center Networking).
• Conditional writes: object storage PUTs that fail if the key exists (If-None-Match) or unless the current ETag matches (If-Match), giving compare-and-swap on a key (Storage: Block, File & Object).
• Control groups (cgroups): the Linux kernel's limits on CPU, memory, I/O, process count and cpusets, with v2's single hierarchy; the limit on every container, and so how far a host is oversold (From chroot to Containers).
• Control plane: the administrative APIs that create, read, update, delete and list resources, more complex and so more failure-prone than the data plane (Regions, Zones, Cells & Quotas).
• CPU credit: the unit of burstable instances, one vCPU at 100% for one minute or any equivalent, earned at a fixed hourly rate set by instance size (Virtualization & the VPS).
• Cross-connect: a point-to-point fiber or copper run inside a data center from a tenant's cabinet through a meet-me room to another tenant, a carrier, an internet exchange or a cloud on-ramp, billed monthly (The Data Center & Colocation).
• Data plane: the part of a service that does its primary function (the running instance, volume reads and writes, bucket GETs and PUTs, DNS answers), kept intentionally simpler than the control plane (Regions, Zones, Cells & Quotas).
• DCQCN: end-to-end ECN-based congestion control for RoCE v2 from Microsoft and Mellanox, so senders slow down before PFC has to pause links (Data Center Networking).
• Dedicated Local Zones: AWS infrastructure built for one customer's exclusive use in a location it specifies, fully managed by AWS as part of a parent Region (Hybrid & On-Prem Cloud).
• Dedicated vCPU: a CPU model with threads pinned to one VM, giving predictable performance at the highest price (Virtualization & the VPS).
• Deep-buffer switch: a switch chip with large packet buffers, placed where many flows converge such as the spine, against shallow-buffer chips at the leaf (Data Center Networking).
• Delete marker: the placeholder that a DELETE without a version ID inserts as the current version in a versioned bucket, leaving earlier versions in place (Storage: Block, File & Object).
• Deployment Stamps: Azure's name for cells, independent copies of a service (stamps or scale units) each serving a set number of tenants and deployed separately (Regions, Zones, Cells & Quotas).
• Distribution specification (OCI): the OCI standard for registries, based on the Docker Registry HTTP API V2, covering pull, push, content discovery and content management (From chroot to Containers).
• Docker Engine: a daemon and CLI over containerd and runc that builds and runs containers in one tool, with a root daemon unless run rootless (From chroot to Containers).
• Docker Swarm: Docker's clustering, built into Docker Engine as swarm mode (docker swarm init and join), minimal to set up but with a small feature set and little momentum (Schedulers: Borg to Kubernetes).
• Durability (object storage): the provider's per-object claim against losing acknowledged data to hardware failure, which depends on fast repair and covers neither the customer's own deletes nor the provider's tooling mistakes (Storage: Block, File & Object).
• E2B: a sandbox service that runs untrusted agent code in Firecracker microVMs that resume from a snapshot and pause when the agent stops (Sandboxes & MicroVMs).
• eBGP (data center): the RFC 7938 design that runs eBGP on every fabric link with private ASNs (one shared by the spines, one per top-of-rack), making BGP the only routing protocol (Data Center Networking).
• EBS snapshot: an incremental backup of a block volume, saving only blocks changed since the previous snapshot, stored in S3 across zones; backups are the customer's job (Storage: Block, File & Object).
• ECMP (equal-cost multipath): routing that spreads traffic over many equal-cost paths by hashing each flow's five-tuple, so one flow's packets stay in order on one path (Data Center Networking).
• ECN: marking packets at a congested switch instead of dropping them, so the receiver tells the sender to slow down (Data Center Networking).
• EFA and SRD: AWS's Elastic Fabric Adapter (ENA plus OS bypass through libfabric) and its Scalable Reliable Datagram transport, reliable but out of order, spraying a flow's packets across many paths from the Nitro card (Data Center Networking).
• EFS throughput modes: Amazon EFS's billing choices for file share throughput: Elastic (billed per data read and written), Provisioned (billed for throughput above what storage includes) and Bursting (baseline plus credits) (Storage: Block, File & Object).
• Endpoint (private): a network object that exposes a service privately inside the customer's virtual network, such as a PrivateLink endpoint appearing as a network interface (Data Center Networking).
• Entry processes (EP): the CloudLinux LVE limit on concurrent entries into an account's container (web requests, SSH sessions, cron), above which Apache returns HTTP 508 (Shared Hosting Isolation).
• Equivalence classes (Borg): a scheduling shortcut that scores one task per group of identical tasks (Schedulers: Borg to Kubernetes).
• F16: Meta's 2019 data center fabric that connected each rack to 16 planes, each a single switch chip, for four times the capacity of its four-plane design (Data Center Networking).
• Fabric: the network that connects every server in a building to every other at a known bandwidth, which went from a tree of ever-larger routers to a mesh of identical small switches (Data Center Networking).
• Falcon: Google's hardware transport, first in the Intel IPU E2000, with hardware RTT measurement, per-flow shaping and fast retransmit, opened through OCP (Data Center Networking).
• Fastly Compute: Fastly's edge functions in WebAssembly on Wasmtime, starting a new sandbox for each request by default (Functions, Isolates & Edge Compute).
• Fault (LVE): CloudLinux's count each time an account hits a limit, recorded by LVE-Stats with a snapshot of its processes and queries and grouped into incidents (Shared Hosting Isolation).
• Fault domain: a rack or hardware group inside one building used for anti-affinity, short of a second building; Oracle offers them inside single-availability-domain regions (Regions, Zones, Cells & Quotas).
• FCGId: the mod_fcgid PHP handler in cPanel, incompatible with mod_ruid2 and mpm-itk and meant for advanced administrators (Shared Hosting Isolation).
• File share: a mounted file system spoken over NFS or SMB to many clients at once, promising POSIX or Windows semantics, locking and throughput (Storage: Block, File & Object).
• Firecracker: AWS's minimal KVM VMM, one process per microVM with only five emulated devices, a jailer and snapshots, which became the industry's microVM for Lambda, Fargate, Fly.io, Cloudflare Containers, Vercel Sandbox and E2B (Sandboxes & MicroVMs).
• Firecracker snapshot: a guest memory file plus a microVM state file, restored by mapping memory privately and loading pages on demand, which should be resumed once because restores share captured randomness and tokens (Sandboxes & MicroVMs).
• Fly.io Machines: Fly.io's images run as Firecracker microVMs through a REST API, billed per second while running (From chroot to Containers).
• FPM (PHP handler): PHP-FPM as a panel's PHP handler, served through mod_proxy_fcgi and running as the pool's user, the per-user default the current panels recommend (Shared Hosting Isolation).
• Frontend and backend networks: the split in AI clusters between a frontend network for data ingestion, checkpointing and logging and a backend network for training traffic with one RDMA NIC per GPU (Data Center Networking).
• Gateways (virtual network): the objects connecting a virtual network to the internet (an internet gateway, or a NAT gateway for outbound-only instances), to on-premises networks and to other networks (Data Center Networking).
• GKE Enterprise: Google's Kubernetes software on the customer's own bare metal or VMware, managed as fleets from Google Cloud (Hybrid & On-Prem Cloud).
• Google Cloud Run: Google's serverless containers and functions, first generation on gVisor and second generation in a microVM with full Linux compatibility, with many concurrent requests per instance (From chroot to Containers).
• Google Distributed Cloud: Google's on-premises offerings: connected (Google-certified hardware the customer maintains, with Google running the software) and air-gapped (Google-engineered racks or appliances completely disconnected from the internet) (Hybrid & On-Prem Cloud).
• Google IPU: an infrastructure processing unit co-designed by Google and Intel that offloads networking with line-rate encryption and carries the Falcon transport (Data Center Networking).
• gp3: the EBS volume type that decouples throughput and IOPS from size, unlike gp2, where customers bought capacity to get speed (Storage: Block, File & Object).
• gVisor: Google's user-space kernel per sandbox, an OCI runtime (runsc) that intercepts system calls so the host kernel sees a small filtered set, needing no hardware virtualization at a CPU cost per syscall (Sandboxes & MicroVMs).
• gVisor Gofer: the host process started with each gVisor container that mediates all filesystem access over 9P, so the Sentry never opens host files (Sandboxes & MicroVMs).
• gVisor platform: how gVisor's Sentry catches system calls, a provider tuning choice between systrap (seccomp traps, the default and better inside a VM) and KVM (Sandboxes & MicroVMs).
• gVisor Sentry: gVisor's largest component, implementing system calls, signals, memory management and threading without passing the application's calls through to the host (Sandboxes & MicroVMs).
• Hoverboards: gateways in Google's Andromeda that carry the long tail of idle flows while the control plane programs direct host-to-host rules only for hot ones (Data Center Networking).
• HTTP 508: the error Apache returns when a CloudLinux account exceeds its entry processes limit (Shared Hosting Isolation).
• Hyperscaler .metal instances: whole bare machines rented by the hour inside a cloud, with its network, storage and IAM, while the provider's card still controls I/O (Dedicated Servers & Bare Metal).
• IBM Cloud Satellite: IBM's model of running a location's control plane from an IBM Cloud metro over hosts the customer supplies in its data center, an edge site or another cloud (Hybrid & On-Prem Cloud).
• Identity, resources and visibility: the three problems each generation of shared hosting isolation fixed: whose user a script runs as, how much one account can use, and what it can see of the server and other accounts (Shared Hosting Isolation).
• Image digest: the content hash that names exactly one set of image bytes, recorded at deploy time so "what was running" has one answer however often a tag moves (From chroot to Containers).
• Image index: the OCI document listing manifests for different platforms, so one image name resolves to an amd64 or arm64 image as the host requires (From chroot to Containers).
• In-memory operating system: the netbooted environment that runs entirely in RAM to inventory hardware, run burn-in tests, wipe disks and write an image, such as Hetzner's Rescue System (Dedicated Servers & Bare Metal).
• INIT, INVOKE and SHUTDOWN: Lambda's execution-environment lifecycle: INIT creates the environment and runs static code, INVOKE runs the handler, and SHUTDOWN ends it; a request landing on a frozen environment is a warm start that skips INIT (Functions, Isolates & Edge Compute).
• Inodes (shared hosting): the count of files and directories an account may hold, enforced through /home quotas; at the hard limit the user can't write new files, which is where "unlimited" storage ends (Shared Hosting Isolation).
• IPMI: the older BMC management protocol, whose version 2.0 added Serial over LAN and stronger authentication and encryption (Dedicated Servers & Bare Metal).
• iPXE: open-source network boot firmware that extends PXE to HTTP, iSCSI and other transports, so a loader can fetch a kernel, initramfs and script with per-machine parameters (Dedicated Servers & Bare Metal).
• Isolates and Wasm at the edge: function platforms (Cloudflare Workers, Fastly Compute) that run in hundreds of locations inside a language runtime, start in milliseconds or less, cap memory and bill CPU time or requests (Functions, Isolates & Edge Compute).
• Jailer (Firecracker): the wrapper that places Firecracker in a chroot with its own PID and network namespaces, dropped privileges and a restrictive seccomp profile before the guest boots (Sandboxes & MicroVMs).
• Job and task (Borg): a Borg job is a set of identical tasks, each with a priority, admitted by quota before scheduling (Schedulers: Borg to Kubernetes).
• Kata Containers: a lightweight VM per pod behind an OCI and CRI runtime, a drop-in hardware boundary for multi-tenant Kubernetes with a choice of VMM (Sandboxes & MicroVMs).
• kube-scheduler: Kubernetes' scheduler, which filters for feasible nodes and scores them, picking the highest with ties broken at random, and preempts lower-priority pods by PriorityClass (Schedulers: Borg to Kubernetes).
• KVM: the Linux kernel module for hardware-assisted virtualization, paired with QEMU or a custom VMM, running any guest OS and used by most clouds and developer clouds (Virtualization & the VPS).
• Lambda@Edge: AWS's functions on CloudFront's origin and viewer events, with larger limits than CloudFront Functions and billing by requests and GB-seconds (Functions, Isolates & Edge Compute).
• Leaf-spine: the two-layer data center fabric where each leaf (top-of-rack switch) connects to every spine, so any server reaches any other in three switch hops and the fabric grows by adding leaves (Data Center Networking).
• Legal hold (Object Lock): an Object Lock protection on an object version with no expiry, lasting until removed (Storage: Block, File & Object).
• Letter of authorization and connecting facility assignment (LOA-CFA): the document the owner of a far port issues naming its panel and port, which the other side gives the colocation operator to order a cross-connect (The Data Center & Colocation).
• libfabric: the OS-bypass interface through which AWS EFA serves MPI and NCCL, also the base of Ultra Ethernet's software (Data Center Networking).
• Lifecycle rule: an object storage rule that transitions objects to colder classes or expires them, applying to existing objects as well as new ones, and a deletion path no bucket policy blocks (Storage: Block, File & Object).
• Live migration: moving a running VM to another host without a reboot, which lets a provider drain a host before maintenance (Virtualization & the VPS).
• Lossless Ethernet: a RoCE fabric configured so switches don't drop packets, with PFC, ECN and congestion control, because RDMA's recovery from loss is expensive (Data Center Networking).
• LSAPI: the LiteSpeed API PHP handler, included by default in cPanel, whose full functionality requires CloudLinux (Shared Hosting Isolation).
• LSMs (AppArmor, SELinux): Linux Security Modules giving mandatory access control over files and operations, applied as one profile for every tenant or per workload (From chroot to Containers).
• LVE: CloudLinux's kernel-level container per account that limits CPU, memory, I/O and processes without separating the filesystem (Shared Hosting Isolation).
• MAAS: Canonical's open-source bare-metal provisioning stack covering a machine's lifecycle from enlistment to release (Dedicated Servers & Bare Metal).
• Manifest (OCI): the document describing the components of a container image: a config and a list of layers, each named by a descriptor with media type, size and content digest (From chroot to Containers).
• Marathon: Mesosphere's container orchestration framework on Apache Mesos, now archived (Schedulers: Borg to Kubernetes).
• Mesos: Apache's two-level scheduler, where the master offers resources and frameworks accept or reject them, retired by the Apache board (Schedulers: Borg to Kubernetes).
• Minimum object size: a storage class's smallest billable object, so small objects bill as if they were that size, in effect a small-object fee (Storage: Block, File & Object).
• Minimum storage duration: an object storage class's minimum billing period, so an object deleted or transitioned early is billed for the rest, in effect a deletion fee (Storage: Block, File & Object).
• mod_lsapi PRO: CloudLinux's Apache module based on the LiteSpeed API that runs PHP like suPHP or PHP-FPM, optionally keeping lsphp running for opcode caching (Shared Hosting Isolation).
• mod_php (DSO): PHP loaded into Apache, running every site as the web server's user, so one compromised site reaches all; legacy only (Shared Hosting Isolation).
• mod_ruid2 and mpm-itk: Apache modules that switch to the owner's user inside the web server, which keeps performance but makes the web server root-equivalent (Shared Hosting Isolation).
• Monolithic scheduler: a scheduler with a single, centralized algorithm for all jobs, as Borg's was at the time Omega's paper named the architectures (Schedulers: Borg to Kubernetes).
• MRC (Multipath Reliable Connection): an extension of RoCE v2 with per-packet multipath and sender-based congestion control over best-effort Ethernet (Data Center Networking).
• Multipart upload: the S3 method for large objects, sending up to thousands of parts that the store assembles, required above the single-PUT size limit (Storage: Block, File & Object).
• MySQL Governor: CloudLinux's limiter for the shared database server, monitoring CPU and read and write bytes per MySQL user and restricting abusers (Shared Hosting Isolation).
• Namespaces (Linux): kernel views (mount, PID, network, UTS, IPC, user, cgroup, time) that a container unshares; a user namespace makes root inside the container unprivileged outside (From chroot to Containers).
• Network (VPC): a customer's private address space in a region (VPC, VNet, VCN), divided into subnets with route tables, gateways and endpoints on top of the shared fabric (Data Center Networking).
• Network boot (PXE): firmware asking DHCP for an address and boot file, then fetching a small loader over TFTP and running it, the first step of automated provisioning (Dedicated Servers & Bare Metal).
• Nitro Cards: AWS's dedicated hardware that implements every outward interface of an EC2 server (VPC network, EBS and local NVMe, encryption and the control-plane API) apart from the main CPUs (Sandboxes & MicroVMs).
• Nitro Controller: the primary Nitro card, the hardware root of trust and the exclusive gateway between the server and the EC2, EBS and VPC control planes (Sandboxes & MicroVMs).
• Nitro Hypervisor: the minimal hypervisor left once I/O moves to Nitro Cards, partitioning CPU and memory and assigning SR-IOV functions of the cards' devices directly to VMs (Sandboxes & MicroVMs).
• Nitro Security Chip: the chip on the main board that moderates firmware access and holds the CPUs in reset until the Nitro Controller verifies everything, which makes bare metal instances safe to rent (Sandboxes & MicroVMs).
• Nomad: HashiCorp's scheduler for service, batch and system jobs, ranking feasible nodes mainly by bin packing and applying plans with optimistic concurrency (Schedulers: Borg to Kubernetes).
• NPROC: the CloudLinux LVE limit on all processes and threads in an account, which should exceed entry processes by a margin (Shared Hosting Isolation).
• Nutanix: a cloud platform software stack sold for customer hardware and for cloud bare metal with portable licenses, a common VMware alternative (Hybrid & On-Prem Cloud).
• NVIDIA BlueField: NVIDIA's DPU line that offloads SDN, storage and security from the host, programmed with the DOCA SDK (Data Center Networking).
• Object Lock (WORM): write-once protection on a specific object version in a versioned bucket; compliance mode can't be overridden even by the root user, and governance mode can by a principal with a bypass permission (Storage: Block, File & Object).
• Object store: an HTTP API of buckets and keys that promises an acknowledged object stays readable for years across a whole region, priced per gigabyte-month (Storage: Block, File & Object).
• OCI Dedicated Region: a complete Oracle cloud region with the public cloud's services installed in the customer's data center, with a large minimum footprint (Hybrid & On-Prem Cloud).
• OpenStack: open-source cloud software with no license fee and every layer replaceable, where the customer operates every service (Hybrid & On-Prem Cloud).
• OpenStack Ironic: bare metal provisioning as an OpenStack compute driver or standalone, with broad drivers (IPMI, Redfish, iDRAC) and cleaning steps (Dedicated Servers & Bare Metal).
• Oracle Compute Cloud@Customer: an Oracle rack installed in the customer's data center and fully managed by Oracle, connected to the customer's OCI tenancy (Hybrid & On-Prem Cloud).
• Overcommit: selling more vCPUs or memory than a host physically has, a product decision that steal time and swapping reveal to customers (Virtualization & the VPS).
• Oversubscription: the ratio of a leaf's downlink bandwidth to its uplink bandwidth; 1:1 is non-blocking, and general-purpose fabrics run oversubscribed as a priced design choice (Data Center Networking).
• Oxide cloud computer: a rack-scale computer sold to the customer with hardware and open-source system software designed together, no separate licensing and an API and console from day one (Hybrid & On-Prem Cloud).
• Pack and spread (scheduling): the two scoring strategies: packing ("best fit") fills machines tightly and leaves whole machines free but penalizes misestimates, while spreading ("worst fit") leaves headroom at the cost of fragmentation (Schedulers: Borg to Kubernetes).
• Packet spraying: sending the packets of one flow across many paths instead of pinning it to one, used by AWS SRD, Spectrum-X and Ultra Ethernet's transport, with reordering at the receiver (Data Center Networking).
• Page sharing: merging identical memory pages across VMs copy-on-write, one of the techniques that made VM density pay (Virtualization & the VPS).
• Partition key (cells): the value (customer ID, resource ID or another present in most calls) that a cell architecture partitions work by, aligned with the grain of the service (Regions, Zones, Cells & Quotas).
• Partitions (InfiniBand): groups of ports identified by a partition key (P_Key) that isolate tenants on a shared InfiniBand fabric (Data Center Networking).
• PFC (Priority Flow Control): a switch telling its upstream neighbor to pause one traffic class when a buffer fills, preventing drops at the cost of head-of-line blocking, congestion spreading and rare deadlocks (Data Center Networking).
• PFC watchdog: a switch mechanism that breaks pause storms when a PFC pause lasts too long (Data Center Networking).
• PHP Selector: CloudLinux's per-user choice of PHP version, modules and settings from its alt-php builds, which requires CageFS (Shared Hosting Isolation).
• PHP-FPM pool: a set of persistent PHP worker processes with its own Unix user and group, socket, optional chroot and locked settings, the per-account identity default on cPanel, Plesk and DirectAdmin (Shared Hosting Isolation).
• Placement groups: the customer-facing control over where instances land on the network, such as a cluster group in one high-bisection-bandwidth segment or partition groups spread across hardware (Data Center Networking).
• Plan queue (Nomad): the leader's queue of placement plans from parallel schedulers that rejects colliding plans at commit (Schedulers: Borg to Kubernetes).
• Platform functions: functions sold by a PaaS such as Vercel or Netlify on a hyperscaler underlay, adding framework integration while inheriting the underlay's limits (Functions, Isolates & Edge Compute).
• PMEM: the CloudLinux LVE limit on physical memory (RSS, shared memory and page cache), at which cache is reclaimed and then processes are killed (Shared Hosting Isolation).
• Pod (fabric): in Facebook's data center fabric, a group of racks served by fabric switches, with pods connected through spine planes (Data Center Networking).
• Podman: a daemonless container engine that runs containers as root or a non-privileged user, with no root daemon (From chroot to Containers).
• Power billing model: how colocation charges for power: an all-in rate per committed kilowatt bundling cooling and overhead, or metered energy plus a space or circuit charge (The Data Center & Colocation).
• Power Usage Effectiveness (PUE): total facility power divided by IT equipment power, the operator's measure of overhead (1.0 would mean every watt reaches a server), which a tenant should ask for per building as operated (The Data Center & Colocation).
• Powered shell: a building with power to it that a wholesale tenant fits out itself (The Data Center & Colocation).
• Preemption: evicting lower-priority work to place higher-priority work; spot and low-priority products are the scheduler's eviction order with a price on it (Schedulers: Borg to Kubernetes).
• Presigned URL: an object storage URL carrying the signing principal's credentials that works for anyone holding it, as often as they like, until it expires (Storage: Block, File & Object).
• Private suite: a walled colocation room with its own access control, sometimes with its own cooling units (The Data Center & Colocation).
• Privileged container: a container holding every capability, which is effectively the host, so it belongs only on capacity the customer owns or inside a VM (From chroot to Containers).
• proxyexec: CloudLinux's path for commands that must run outside a user's CageFS, filtered by a list (Shared Hosting Isolation).
• QP scaling: spreading RoCE traffic over more queue pairs in the collective library so ECMP hashing on the destination queue pair finds more paths, as in Meta's training clusters (Data Center Networking).
• Quota: a limit on what one account or project may hold or do, per region, which protects the fleet, other tenants and the customer's own bill, and decides admission before the scheduler decides placement (Regions, Zones, Cells & Quotas).
• Rack unit (U): the standard height of rack-mounted equipment, 1.75 inches, in which cabinets and single-server colocation are sold (The Data Center & Colocation).
• Rail-optimized: an AI backend design where GPU n in every node connects to leaf switch n, its rail, so same-rank traffic is one switch hop and only cross-rail traffic climbs to the spine (Data Center Networking).
• Read-after-write consistency: the guarantee that a GET or LIST after a successful PUT sees the new data, which S3 gives strongly (Storage: Block, File & Object).
• Redfish: the REST API for BMCs on current servers, with serial console over SSH among its functions, preferred over IPMI (Dedicated Servers & Bare Metal).
• Region: a metro area with its own control plane, its own prices and usually its own legal home, the customer-facing footprint of a provider (Regions, Zones, Cells & Quotas).
• Regional functions: function platforms (AWS Lambda, Cloud Run functions, Azure Functions) that run in a cloud region in a microVM or container and bill memory multiplied by duration (Functions, Isolates & Edge Compute).
• Relaxed randomization: a Borg scheduling shortcut that examines machines in random order until enough feasible ones are found (Schedulers: Borg to Kubernetes).
• Remote hands: the colocation operator's staff doing physical work on a tenant's equipment (rack and stack, cross-connect termination, power cycling, swaps), run as a billable work order in fixed increments (The Data Center & Colocation).
• Reservation (Borg): a task's reserved resources, starting at its limit and decaying toward actual usage plus a margin, with the gap lent to batch work (Schedulers: Borg to Kubernetes).
• Resource offer: Mesos's mechanism, in which Mesos decides how many resources to offer each framework and the framework decides which to accept and what to run (Schedulers: Borg to Kubernetes).
• Resource versus asset: the split between a customer's server resource, which keeps its ID, addresses and bill, and the physical asset backing it, recorded over time in server_assignments (Dedicated Servers & Bare Metal).
• Retail colocation: cabinets, cages and suites sold to many tenants with power, cooling, security and remote hands bundled, fast to start but higher per kilowatt than wholesale (The Data Center & Colocation).
• RoCE v2: RDMA over Converged Ethernet with routing through UDP headers, the Ethernet alternative to InfiniBand for AI fabrics (Data Center Networking).
• Route tables: the virtual network objects that say where traffic for each prefix goes (Data Center Networking).
• runc: the reference OCI runtime (with crun as an alternative) under containerd or CRI-O, running containers with namespaces and cgroups on the host kernel at native speed (From chroot to Containers).
• runsc: gVisor's OCI runtime, called by Docker, containerd and Kubernetes in place of runc (Sandboxes & MicroVMs).
• Runtime specification (OCI): the OCI standard for the bundle a runtime receives (a root filesystem plus config.json), its execution environment and its lifecycle (From chroot to Containers).
• S3-compatible challengers: object stores (R2, B2, Wasabi, Hetzner, Spaces, OVHcloud, Akamai) that speak the S3 API with low or zero egress, where compatibility is a matrix of implemented features rather than a checkbox (Storage: Block, File & Object).
• Scale-out: connecting GPU nodes or racks across a building over InfiniBand or Ethernet with one NIC per GPU (Data Center Networking).
• Scale-up: connecting GPUs inside a node or rack with dedicated GPU-to-GPU links such as NVLink (Data Center Networking).
• Score caching: a Borg scheduling shortcut that keeps machine scores until the machine or task changes (Schedulers: Borg to Kubernetes).
• seccomp: the Linux filter on which system calls a process may make; the provider chooses the default filter and whether customers may relax it (From chroot to Containers).
• Segment ID: the VNI, VLAN ID or InfiniBand P-Key that maps exactly one tenant network, never shared and never shown to the customer (Data Center Networking).
• Serverless containers: a billing model (Fargate, Cloud Run, Container Instances, Fly.io) charging a container's declared size for the time it runs, with the provider owning bin packing (From chroot to Containers).
• Service link (Outposts): the encrypted set of VPN connections from an Outpost to its parent Region, carrying customer VPC traffic and management traffic, whose loss the provider-operated racks treat as a fault (Hybrid & On-Prem Cloud).
• Shallow-buffer switch: a switch chip with small shared buffers, used at the leaf, against deep-buffer chips where flows converge (Data Center Networking).
• Shared vCPU: an overcommitted, best-effort CPU model with no meter, cheap and simple but subject to steal under contention (Virtualization & the VPS).
• Shared-kernel containers (OpenVZ, Virtuozzo, LXC): one kernel with many isolated user spaces, the highest-density VPS model, where a kernel bug reaches every tenant and the customer can't choose the kernel (Virtualization & the VPS).
• Shared-state scheduler: Omega's architecture, where several schedulers each see the whole cluster and commit placements as optimistic transactions, retrying on conflict (Schedulers: Borg to Kubernetes).
• SHARP: the Scalable Hierarchical Aggregation and Reduction Protocol, which moves reductions into InfiniBand switches so they add partial sums in transit (Data Center Networking).
• Shuffle sharding: giving each customer its own random combination of workers instead of a fixed group, so one customer's load or attack reaches few others (Regions, Zones, Cells & Quotas).
• Slot (Lambda): a Firecracker microVM holding a single sandbox for a single customer function with a minimized kernel and userland, used for one concurrent invocation and recycled within hours (Sandboxes & MicroVMs).
• SONiC: Microsoft's open-source switch operating system, built on OCP's Switch Abstraction Interface and now at the Linux Foundation, running on many switch models (Data Center Networking).
• Sovereign partition: a separate control plane, identity system and operations staff for a jurisdiction (AWS European Sovereign Cloud, Azure Government, OVHcloud SecNumCloud), not just another region (Regions, Zones, Cells & Quotas).
• Spectrum-X: NVIDIA's AI Ethernet, Spectrum-4 switches coupled with BlueField-3 SuperNICs, with adaptive routing that sprays packets and reorders them in host memory (Data Center Networking).
• SPEED: the CloudLinux LVE limit on CPU as a percentage of one core, above which the account's processes are throttled (Shared Hosting Isolation).
• Standard and Unlimited modes: AWS burstable modes: Standard spends banked credits and drops to baseline at zero, while Unlimited spends surplus credits and bills the excess above a rolling 24-hour baseline (Virtualization & the VPS).
• Static stability: the design rule that systems keep operating normally without making changes while a dependency, such as a control plane, is failed or unavailable (Regions, Zones, Cells & Quotas).
• Steal time: the gap a Linux guest reports in /proc/stat while the hypervisor runs another guest, the customer's only direct view of a noisy neighbor (Virtualization & the VPS).
• Subnet manager: the InfiniBand service (OpenSM is the open one) that must run per subnet to scan, initialize and sweep the fabric and compute forwarding (Data Center Networking).
• Subnets: the divisions of a virtual network, usually one or more per zone (Data Center Networking).
• suEXEC and suPHP: the per-request models that run PHP as the site owner, isolating identity at the cost of a process per request; suPHP is unmaintained (Shared Hosting Isolation).
• Surplus credits: credits an Unlimited burstable instance spends beyond its bank, paid down by later earnings or billed per vCPU-hour above baseline (Virtualization & the VPS).
• System limits: fixed provider limits that, unlike adjustable quotas, can't be raised (Regions, Zones, Cells & Quotas).
• TIA-942: a data center rating standard from Rated-1 (basic site infrastructure) through Rated-3 (concurrently maintainable) to Rated-4 (fault tolerant) (The Data Center & Colocation).
• Tinkerbell: a CNCF sandbox bare-metal provisioner running workflows of containerized actions over iPXE, small and Kubernetes-native (Dedicated Servers & Bare Metal).
• Two-level scheduler: a scheduler where one resource manager offers resources to independent frameworks that pick what to run, as Mesos did (Schedulers: Borg to Kubernetes).
• UALink: the open specification for scale-up links among accelerators within an AI computing pod, an alternative to NVLink (Data Center Networking).
• Ultra Ethernet Consortium: the Linux Foundation project defining Ultra Ethernet and its transport (UET), with packet spraying, receiver-granted credits, Link Level Retry and ephemeral connections; it has no compliance program, so hardware is "UEC-ready," not compliant (Data Center Networking).
• Undersubscription: building more uplink capacity than downlink (Meta's AI backend started at 1:2) to work around routing collisions (Data Center Networking).
• Uptime Institute Tier Standard: the four-level data center rating by power and cooling topology, from Tier I to Tier IV, where Tier III is concurrently maintainable and Tier IV survives an unplanned failure of one component (The Data Center & Colocation).
• User Beancounters: OpenVZ's per-container counters with limits, guarantees and a fail counter that recorded each time a container hit one (Virtualization & the VPS).
• V8 isolates: many tenants in one V8 process, starting in milliseconds with tiny memory each, limited to JavaScript and Wasm, where a V8 bug is a cross-tenant bug (Sandboxes & MicroVMs).
• Variable retention: an Object Lock setting that sets the retain-until date when an event hold is released, for retention starting at a business event such as account closure (Storage: Block, File & Object).
• vCPU: a hardware thread of a physical core, not a core, so two vCPUs can be one physical core (Virtualization & the VPS).
• Vercel Functions: Vercel's functions on an AWS underlay, billed on active CPU time plus provisioned memory, with Fluid compute letting each instance handle multiple requests (Functions, Isolates & Edge Compute).
• Vercel Sandbox: Vercel's product for running code in a Firecracker microVM with its own filesystem and network (Sandboxes & MicroVMs).
• Versioning (object storage): a bucket setting under which overwrites create new whole-object versions and deletes add delete markers; once enabled it can only be suspended, never removed (Storage: Block, File & Object).
• Virtual network: the private address space, subnets, routes and firewall rules each customer gets on the shared fabric, which moved from switches into host software and then into a card in each server (Data Center Networking).
• VMware Cloud Foundation: the incumbent enterprise private cloud stack, subscription-only and per-core since Broadcom ended perpetual licenses (Hybrid & On-Prem Cloud).
• VMware ESXi (vSphere): Broadcom's proprietary type 1 hypervisor with mature management, sold by subscription only (Virtualization & the VPS).
• VXLAN: the RFC 7348 overlay that carries a 24-bit segment ID over UDP, escaping the VLAN limit for tenant networks (Data Center Networking).
• Wasabi: an S3-compatible object store with one flat price per TB and a minimum storage duration on pay-as-you-go (Storage: Block, File & Object).
• Wasm runtimes: WebAssembly sandboxes such as Wasmtime that start an instance per request or session in microseconds with capability-based imports, limited by language support and WASI (Sandboxes & MicroVMs).
• Wholesale colocation: megawatts of space or a powered shell leased to one tenant on long terms, who fits it out and operates it while the operator handles the building (The Data Center & Colocation).
• Zone (availability zone): a set of buildings inside a region with separate power, cooling and networking, close enough for synchronous replication and far enough apart that one disaster shouldn't take two (Regions, Zones, Cells & Quotas).
• Zone name mapping: the practice of mapping physical zones to names differently per customer to spread load, so "zone a" in two accounts can be different buildings, with stable physical IDs available (Regions, Zones, Cells & Quotas).

Kubernetes#

• Admission (Kubernetes): the API server stage after authorization where mutating and then validating admission (built-in plugins, webhooks and in-process CEL policies) can change or reject a request (Kubernetes Architecture).
• Admission webhook: a remote call the API server makes on every matching write, allowing any logic, but a network service in the request path; with failure policy Fail it becomes a dependency of every write (Kubernetes Architecture).
• Aggregated API server: a separate API server proxied through an APIService, with its own storage and validation, for APIs whose data isn't a key-value document (Kubernetes Architecture).
• AKS Automatic: an AKS Standard-tier cluster preconfigured with node auto-provisioning, the stable upgrade channel and node auto-repair, adding a pod readiness SLA (Managed Kubernetes).
• AKS cost analysis: Azure's cost allocation add-on built on OpenCost and reconciled with the Azure invoice, on Standard and Premium tiers (Autoscaling & Cost).
• AKS Pod Sandboxing: AKS's sandboxed runtime, running Kata Containers on Azure Linux node pools, selected with runtimeClassName: kata-vm-isolation (Multi-Tenancy, Policy & Security).
• API Priority and Fairness (APF): the API server's self-protection that divides its request concurrency among priority levels, so classes of request can't starve each other, with fair queuing within a level (Kubernetes Architecture).
• API server: the Kubernetes component every client talks to, which passes each request through transport, authentication, authorization, admission and validation before writing it to etcd (Kubernetes Architecture).
• Application (Argo CD): Argo CD's central object, naming a source (repository, revision and path or chart) and a destination cluster and namespace, with a sync status and a health status (Packaging & GitOps).
• ApplicationSet: the Argo CD object that generates Applications from a template and generators (List, Cluster, Git, Matrix), how one manifest deploys to a fleet (Packaging & GitOps).
• AppProject: Argo CD's tenancy boundary, limiting the repositories an application may pull from, the clusters and namespaces it may deploy to and the kinds it may create (Packaging & GitOps).
• Argo CD: a hub GitOps controller with a UI, Applications and AppProjects that pulls desired state from Git and reconciles clusters to it; the hub holds credentials for every cluster it manages (Packaging & GitOps).
• Argo Rollouts: a progressive delivery controller that replaces Deployments with Rollouts, adding steps, analysis, blue-green and canary (Packaging & GitOps).
• AWS split cost allocation data: AWS's addition of ECS task and EKS pod line items to the Cost and Usage Report, with usage records per pod for CPU and memory (Autoscaling & Cost).
• Azure Container Apps: Microsoft's serverless container service, scaling on HTTP traffic, events, CPU, memory and KEDA's scalers, with most apps able to scale to zero (Distributions & Alternatives).
• Base and overlay (Kustomize): a base is a directory with a kustomization.yaml of resources and customization; an overlay refers to other kustomization directories and changes them with transformers, while the base knows nothing of its overlays (Packaging & GitOps).
• Binding (scheduler): the scheduler's final step, telling the API server which node it picked for a pod (Kubernetes Architecture).
• Bottlerocket: AWS's open-source Linux built to run containers, updating by downloading a whole filesystem image to the inactive of two partition sets and rebooting into it (Distributions & Alternatives).
• Calico: Tigera's Apache 2.0 networking and network policy project for Kubernetes, with a full eBPF data plane beside nftables (Cluster Networking).
• Capsule: a multi-tenancy project that groups namespaces into a Tenant with inherited quotas, RBAC and policies, using its own policy engine (Multi-Tenancy, Policy & Security).
• Chart (Helm): a directory with a required Chart.yaml and reserved subdirectories for templates, dependencies and CRDs, plus default values, the unit Helm packages and installs (Packaging & GitOps).
• Cilium: an eBPF networking project that began as a CNI and grew into network policy, kube-proxy replacement, encryption, BGP, multi-cluster, a sidecarless mesh and observability (Cluster Networking).
• Cilium kube-proxy replacement: Cilium's eBPF implementation of ClusterIP, NodePort, LoadBalancer and external IPs, with socket-level load balancing that connects a socket straight to a backend (Cluster Networking).
• cloud-controller-manager: the Kubernetes component that integrates with the cloud provider, whose controllers turn Node objects into machines and type: LoadBalancer Services into the provider's load balancers (Kubernetes Architecture).
• CloudNativePG: an Apache 2.0 Postgres operator in the CNCF that declares a database cluster as a Cluster resource and relies on Postgres's own replication rather than storage-level replication (Storage & Stateful Workloads).
• Cluster API: a Kubernetes project in which a management cluster reconciles Cluster, Machine, MachineDeployment and control plane objects through infrastructure, bootstrap and control plane providers (Managed Kubernetes).
• Cluster Autoscaler: the node autoscaler that scales node groups it is told about (sets of identical machines, usually one cloud group each) and never creates a group (Autoscaling & Cost).
• Cluster idle cost: capacity no workload claimed, which OpenCost defines as asset costs minus workload costs and keeps separate, to be distributed among tenants optionally (Autoscaling & Cost).
• Cluster per tenant: the hardest Kubernetes tenancy model, a whole cluster per tenant, isolating everything Kubernetes shares at the cost of a control plane fee and unshared capacity (Multi-Tenancy, Policy & Security).
• Cluster-scoped objects: Kubernetes objects outside any namespace (CRDs, StorageClasses, webhooks, ClusterRoles, PersistentVolumes, Namespaces), which namespace-per-tenant isolation doesn't separate (Multi-Tenancy, Policy & Security).
• CNI (Container Network Interface): the plugin specification through which container runtimes implement the Kubernetes network model; interface plugins create a pod's interface and chained plugins adjust an existing one (Cluster Networking).
• Compaction and defragmentation (etcd): etcd maintenance that discards old revisions to avoid performance degradation and space exhaustion, then reclaims the freed space per member (Kubernetes Architecture).
• Config Sync: Google's in-cluster GitOps reconciler driven by RootSync and RepoSync objects, bundled with GKE and fleets (Packaging & GitOps).
• Conformance (Certified Kubernetes): the check that a managed service or distribution implements the Kubernetes API, which lets customers move manifests in and out; it covers only the API, not add-ons (Kubernetes Architecture).
• Container Runtime Interface (CRI): the gRPC protocol between the kubelet and the container runtime; Docker never implemented it, which led to dockershim and its removal (Kubernetes Architecture).
• Controller (Kubernetes): a control loop that moves the cluster's current state toward the desired state written in the API, usually reading one kind and writing another (Kubernetes Architecture).
• CRD with a controller: extending Kubernetes by adding a kind's schema to the main API server and a controller that reconciles it, so kubectl, RBAC, watch and GitOps work unchanged (Kubernetes Architecture).
• CRDs in Helm: CustomResourceDefinitions shipped in a chart's crds/ directory, installed before the rest and then never reinstalled, upgraded or deleted by Helm (Packaging & GitOps).
• CSI (Container Storage Interface): the plugin interface for Kubernetes storage, with Identity, Controller (create, attach, snapshot, expand) and Node (stage and publish mounts) services (Storage & Stateful Workloads).
• D2iQ: formerly Mesosphere, the company whose Kubernetes platform (DKP) and engineers Nutanix acquired (Distributions & Alternatives).
• EKS add-ons: EKS's managed set of cluster components: AWS add-ons built and supported by AWS, Marketplace add-ons supported by partners, and community add-ons validated only for version compatibility (Managed Kubernetes).
• EKS Auto Mode: EKS mode where AWS manages compute selection and scaling, OS patching, load balancing, storage, networking and core add-ons, with those controllers on AWS-owned infrastructure (Managed Kubernetes).
• EKS Hybrid Nodes: attaching on-premises and edge machines to an EKS cluster, with AWS running the control plane and the customer managing and upgrading the nodes (Managed Kubernetes).
• EKS on Fargate: running each EKS pod on its own Fargate node selected by a Fargate profile, a VM per pod by construction, not upgraded with the control plane (Managed Kubernetes).
• Encryption at rest (etcd): encrypting resources such as Secrets before the API server writes them to etcd, which is plain text by default, ideally through a KMS v2 provider with a recorded key owner (Kubernetes Architecture).
• etcd: the consistent, highly available key-value store for all Kubernetes API server data, using Raft and needing a quorum of an odd number of members, the part that decides a control plane's availability and recovery (Kubernetes Architecture).
• Extended support: a provider's paid support for a Kubernetes minor after standard support ends (EKS extended support, GKE's Extended channel, AKS long-term support), priced well above the standard control plane fee and ending in a forced upgrade (Managed Kubernetes).
• External etcd: an HA topology with a dedicated etcd cluster separate from the control plane nodes, separating failure domains at the cost of twice the hosts (Kubernetes Architecture).
• Falco: a CNCF runtime detection tool that watches system calls and audit logs for behavior admission control can't see, raising alerts only (Multi-Tenancy, Policy & Security).
• Filtering and scoring: the Kubernetes scheduler's two steps: filtering finds nodes where a pod can feasibly run (leaving it Pending if none), and scoring ranks them, with ties broken at random (Kubernetes Architecture).
• Finalizers: namespaced keys on an object that make Kubernetes wait for conditions before deleting it, leaving it terminating until every finalizer is removed (Kubernetes Architecture).
• Flagger: a progressive delivery controller in the Flux project that wraps existing Deployments for canary and blue-green without changing workload manifests (Packaging & GitOps).
• FlowSchema: the API Priority and Fairness object that classifies each request by its attributes into a priority level with its own concurrency limit (Kubernetes Architecture).
• Flux: a CNCF-graduated set of per-cluster GitOps controllers (source, kustomize, helm, notification and image automation) that pull and apply with impersonation, holding no central credentials (Packaging & GitOps).
• Flux Kustomization: the Flux object (not Kustomize's file) that applies a path from a source on an interval, detecting and by default reverting drift, as an impersonated service account (Packaging & GitOps).
• Fly Machines: Fly.io's VMs with a fast REST API, Firecracker microVMs built from Docker images and placed on specific hardware, the clearest case of a provider building below Kubernetes (Distributions & Alternatives).
• Forced upgrade (Kubernetes): a provider's upgrade of a cluster at the end of its support, standard or paid, whatever the customer's settings; the notice and what it overrides are where providers differ (Managed Kubernetes).
• Gateway API: the successor to Ingress that splits routing into roles: a GatewayClass names an implementation, a Gateway requests listeners on an address, routes such as HTTPRoute attach rules, and ReferenceGrant authorizes cross-namespace references (Cluster Networking).
• GKE Autopilot: GKE's node-less mode where Google SREs manage the nodes and the customer sees pods and is billed for their requests (Managed Kubernetes).
• GKE cost allocation: GKE's export of cluster, namespace, workload and promoted label dimensions into the detailed BigQuery billing export (Autoscaling & Cost).
• GKE Sandbox: GKE's sandboxed runtime, enabling gVisor or microVMs on node pools selected through RuntimeClass, with feature restrictions such as no privileged containers (Multi-Tenancy, Policy & Security).
• Health (Argo CD): an Application's status saying whether its objects work (Healthy, Progressing, Degraded, Suspended, Missing, Unknown), separate from sync status (Packaging & GitOps).
• Helm: the Kubernetes package manager of Go templates plus values and releases with history, the distribution format for third-party software, which hides what is applied behind templates (Packaging & GitOps).
• Helm 4: the Helm release that kept the chart format and added server-side apply, kstatus waiting, WebAssembly plugins and content-cached charts (Packaging & GitOps).
• Helm hooks: objects run at points in a release lifecycle (pre- and post-install, upgrade, rollback, delete, and test) set by an annotation, which the release doesn't track afterward (Packaging & GitOps).
• HelmRelease: the Flux object that installs a chart through Helm actions, merging values from ConfigMaps, Secrets and inline values (Packaging & GitOps).
• Horizontal Pod Autoscaler (HPA): the control loop in kube-controller-manager that sets a workload's replica count from utilization of requests or from custom or external metrics (Autoscaling & Cost).
• Immutable node operating system: a node OS taken out of the customer's hands and upgraded as a whole image with Kubernetes, such as Talos Linux, Bottlerocket and RHEL CoreOS (Distributions & Alternatives).
• Impersonation (Flux): a Flux controller acting as the service account named in serviceAccountName, which limits what a Kustomization can change (Packaging & GitOps).
• In-process CEL admission: ValidatingAdmissionPolicy and MutatingAdmissionPolicy evaluated in the API server, with no process to secure or network hop but only the request and its context as inputs (Kubernetes Architecture).
• Informers: the client-library pattern that lists and watches a kind through a Reflector, stores changes in a local indexed cache and calls the controller's handlers (Kubernetes Architecture).
• Istio: a CNCF-graduated service mesh built on the Envoy proxy, classically a sidecar in every pod and now also ambient mode with a ztunnel per node and optional waypoints (Cluster Networking).
• k3s: Kubernetes cut down for small machines in one binary, a distribution rather than a fork, defaulting to an SQLite datastore through Kine (Distributions & Alternatives).
• Kamal: 37signals' MIT-licensed deploy tool (introduced as MRSK) that deploys web apps in containers to any servers, with kamal-proxy switching traffic, a deploy tool rather than a scheduler (Distributions & Alternatives).
• Karpenter: a node autoscaler that drops node groups, watching unschedulable pods and launching individual instances that fit their requirements under NodePool constraints (Autoscaling & Cost).
• Karpenter NodePool, NodeClass and NodeClaim: Karpenter's objects: a NodePool says what may be launched and how it may be disrupted, an EC2NodeClass (or AKSNodeClass) holds provider specifics, and a NodeClaim records one requested node (Autoscaling & Cost).
• KEDA: an event-driven autoscaler that scales workloads between zero and one itself and serves event-source metrics so an HPA it owns scales from one to N (Autoscaling & Cost).
• Kine: an etcd shim that provides an etcd-compatible API over SQL databases (MySQL, PostgreSQL) or SQLite, letting many clusters share a managed database or a small one embed its store (Kubernetes Architecture).
• kOps: a Kubernetes SIG CLI that provisions HA clusters on supported clouds, leaving everything after provisioning to the operator (Managed Kubernetes).
• kube-proxy: the per-node proxy that programs the kernel to rewrite traffic for a Service's virtual IP to a ready pod, in iptables, nftables or the deprecated IPVS mode (Cluster Networking).
• kubeadm: the Kubernetes tool that bootstraps a minimum viable, best-practice cluster, the building block under other installers, with no machines or day-2 lifecycle of its own (Managed Kubernetes).
• Kubecost: IBM's commercial Kubernetes cost product built on OpenCost, with multi-cluster views and recommendations (Autoscaling & Cost).
• Kustomize: template-free Kubernetes configuration of bases and overlays in plain YAML, built into kubectl (Packaging & GitOps).
• Kyverno: a CNCF-graduated Kubernetes policy engine whose policies are Kubernetes resources, including verifyImages rules that check image signatures and attestations (Multi-Tenancy, Policy & Security).
• LimitRange: a namespace object, enforced by the LimitRanger admission plugin, that checks pods against minimums and maximums and applies default requests to pods that specify none (Multi-Tenancy, Policy & Security).
• Linkerd: the service mesh created by Buoyant, the first to graduate in the CNCF, for which Buoyant stopped publishing open source release artifacts from 2.15 (Cluster Networking).
• List, then watch: the Kubernetes client pattern of listing a kind and then watching from the returned resourceVersion, to get the current state and every later change (Kubernetes Architecture).
• Managed Kubernetes: a provider-run control plane (EKS, GKE, AKS, DOKS, LKE, OKE) with customer or provider nodes, a conformant API with forced upgrades and extended-support fees (Distributions & Alternatives).
• Multi-team and multi-customer tenancy: the two Kubernetes tenancy cases: multi-team, where tenants are teams using the API with RBAC, quotas and network policies, and multi-customer, where customers never see the cluster (Multi-Tenancy, Policy & Security).
• MutatingAdmissionPolicy: the in-process counterpart to mutating webhooks, CEL expressions in the API server that produce an apply configuration or a JSON patch (Multi-Tenancy, Policy & Security).
• Namespace per tenant: the soft Kubernetes tenancy model of namespaces with Roles, quotas and network policies, cheap but leaving cluster-scoped objects, nodes, the API server and DNS shared (Multi-Tenancy, Policy & Security).
• Node controller: the controller that assigns pod CIDRs, reconciles nodes with the cloud's machines and monitors node health, deciding what happens when a provider's machine fails (Kubernetes Architecture).
• Node pool: a group of identical nodes in a managed cluster that owns its upgrade parameters (surge, unavailability, drain timeout, soak), set per pool by every provider (Managed Kubernetes).
• Node-less mode: a managed Kubernetes mode where the provider runs the nodes as well as the control plane (Autopilot, Auto Mode, AKS Automatic, Fargate, virtual nodes), with less hardware control (Managed Kubernetes).
• OKE virtual nodes: Oracle's serverless node pools on enhanced clusters, charged per virtual node-hour with pods paying for the compute they consume (Managed Kubernetes).
• Omni: Sidero Labs' fleet manager for Talos clusters, source-available under the Business Source License, free for non-production use (Distributions & Alternatives).
• OPA Gatekeeper: the Kubernetes policy engine based on Open Policy Agent, where a ConstraintTemplate holds Rego logic and a schema and a Constraint instantiates it; the engine behind GKE's and AKS's policy products (Multi-Tenancy, Policy & Security).
• OpenCost: a CNCF vendor-neutral Kubernetes cost allocation specification and agent that bills workloads at the larger of request and usage and keeps idle and overhead explicit (Autoscaling & Cost).
• OpenShift: Red Hat's Kubernetes distribution, whose operators upgrade every component including Kubernetes and the RHEL CoreOS host (Distributions & Alternatives).
• Operator pattern: combining custom resources and custom controllers to encode domain knowledge for an application into an extension of the Kubernetes API (Kubernetes Architecture).
• Optimistic concurrency (Kubernetes): updates carry the resourceVersion they were based on, and the API server returns 409 Conflict if the object changed, so controllers reread and retry instead of locking (Kubernetes Architecture).
• Overlay CNI: pod networking on a private range with SNAT on egress (Azure CNI Overlay, flannel, Calico IP-in-IP or VXLAN), conserving VPC space but hiding pods behind node IPs (Cluster Networking).
• Owner references: links that tell the control plane which objects depend on others, so deleting an owner cascades to its dependents (Kubernetes Architecture).
• Packaging and delivery: the two problems of shipping to Kubernetes: describing, parameterizing and versioning a set of objects (Helm, Kustomize), and getting them from a repository into a running cluster with drift noticed (Argo CD, Flux) (Packaging & GitOps).
• PersistentVolume (PV): a cluster-scoped piece of storage, created statically or dynamically by a driver, bound one-to-one to a claim (Storage & Stateful Workloads).
• PersistentVolumeClaim (PVC): a workload's request for storage in its namespace (size, access modes, volume mode and class), a claim check on a volume (Storage & Stateful Workloads).
• Pod Security Admission: the built-in admission controller that enforces the Pod Security Standards levels (privileged, baseline, restricted) per namespace through labels (Multi-Tenancy, Policy & Security).
• Pod-billed modes: cluster billing where the provider runs nodes and the customer pays for pod requests or pod-sized compute (Autopilot, Fargate, OKE virtual nodes), moving the packing gap to the provider (Autoscaling & Cost).
• PriorityClass: an object mapping a name to an integer priority, so the scheduler can preempt lower-priority pods when the cluster is full, with higher values reserved for system-critical classes (Kubernetes Architecture).
• Provider VPC CNI: pod networking where pods get VPC addresses (Amazon VPC CNI, GKE alias IPs, Azure Pod Subnet, OKE VCN-native), routable and attributable but subject to address exhaustion (Cluster Networking).
• Provisioned control plane: EKS's tiers of pinned control plane capacity sold on top of the cluster fee for very large or bursty clusters (Managed Kubernetes).
• Rancher: SUSE's management plane for many Kubernetes clusters rather than a single distribution (Distributions & Alternatives).
• Reclaim policy: a StorageClass's setting (defaulting to Delete) for whether a volume's data survives when its claim is released, in effect a data-loss setting (Storage & Stateful Workloads).
• Release (Helm): one installation of a chart in a namespace under a name, with a numbered history of revisions, upgraded by three-way merges and acting with the caller's permissions (Packaging & GitOps).
• Request gap: the waste between what pods request and what they use, plus space left over on nodes and node overhead, which node autoscalers buy capacity for (Autoscaling & Cost).
• Requests (Kubernetes): the CPU and memory a pod reserves, which the scheduler and every autoscaler decide on instead of usage, so a cluster can be fully booked and mostly idle (Autoscaling & Cost).
• ResourceQuota: a namespace object that caps what the namespace can consume and create, rejecting requests that would exceed it and requiring pods to set requests or limits for capped resources (Multi-Tenancy, Policy & Security).
• RHEL CoreOS: OpenShift's fully immutable, container-optimized host operating system, upgraded by OpenShift's operators (Distributions & Alternatives).
• Rook: the open-source cloud-native storage orchestrator for Kubernetes, in practice the Ceph operator that deploys and runs Ceph for block, file and object storage on the cluster's nodes (Storage & Stateful Workloads).
• RuntimeClass: the cluster-scoped Kubernetes object that selects a CRI runtime configuration such as a sandbox, adding its overhead to every pod and steering pods to nodes that support it (Multi-Tenancy, Policy & Security).
• Scheduling framework: the plugin architecture of the Kubernetes scheduler, with ordered extension points from PreEnqueue through Filter, Score and Reserve to Bind and PostBind (Kubernetes Architecture).
• Service (Kubernetes): a stable virtual IP for a selector of pods, typed ClusterIP, NodePort or LoadBalancer, where type: LoadBalancer buys a billed provider load balancer (Cluster Networking).
• ServiceExport and ServiceImport: the Multi-Cluster Services API objects that declare a Service exported to other clusters in a clusterset and describe a service imported from it (Cluster Networking).
• sigstore policy-controller: an admission controller that validates images in opted-in namespaces against ClusterImagePolicy signature and attestation rules (Multi-Tenancy, Policy & Security).
• Skew policy: the Kubernetes version skew policy, saying which components may differ in version and by how much, and so the order in which a cluster must upgrade (Kubernetes Architecture).
• Stacked etcd: the HA topology with an etcd member on each control plane node, fewest machines but with failed coupling, so a lost node is an API server and a member together (Kubernetes Architecture).
• StatefulSet: the workload kind giving pods a stable identity (ordinal names and DNS under a headless Service), stable storage through per-pod claims, and ordered rollout, without database logic (Storage & Stateful Workloads).
• StorageClass: how Kubernetes makes volumes: a provisioner (the CSI driver), its parameters, a reclaim policy, expansion and binding mode (Storage & Stateful Workloads).
• Sync phases and waves (Argo CD): the ordering of an Argo CD sync through hooks in PreSync, Sync, PostSync, SyncFail and PostDelete phases and numbered waves (Packaging & GitOps).
• Sync status (Argo CD): whether an Application's live objects match its rendered source (Packaging & GitOps).
• Talos Linux: Sidero Labs' immutable, API-driven OS for Kubernetes with no SSH, shell or package manager, managed over mutual-TLS gRPC and upgraded with Kubernetes as one atomic image (Distributions & Alternatives).
• Tanzu (after Broadcom): VMware's Kubernetes line restructured by Broadcom, with standalone TKG ended and Kubernetes moved into vSphere Supervisor and VKS inside VMware Cloud Foundation (Distributions & Alternatives).
• ValidatingAdmissionPolicy: a declarative alternative to validating webhooks, CEL expressions evaluated inside the API server with no webhook process or network hop (Multi-Tenancy, Policy & Security).
• Values (Helm): a chart's interface: defaults in values.yaml, overridden field by field by user files and --set flags (Packaging & GitOps).
• vCluster: a virtual control plane per tenant on a host cluster; with shared nodes it is not a security boundary for untrusted tenants, while private nodes give each tenant its own CNI, CSI and compute (Multi-Tenancy, Policy & Security).
• Velero: an Apache 2.0 cluster backup tool that saves API objects to object storage and volumes by snapshot or file copy, for backup, restore and migration (Storage & Stateful Workloads).
• Vertical Pod Autoscaler (VPA): a recommender, updater and admission controller outside core Kubernetes that computes and applies pod requests, closing the request gap (Autoscaling & Cost).
• Virtual control plane per tenant: a tenancy model giving each tenant its own API server, controller manager and etcd synced to shared nodes, isolating the control plane but not the data plane (Multi-Tenancy, Policy & Security).
• WaitForFirstConsumer: the late volume binding mode every provider's default class uses, so a zone-bound disk is created only after the scheduler picks the pod's node (Storage & Stateful Workloads).
• Watch cache: the API server's in-memory mirror of etcd data that serves lists and watches, keeping thousands of watchers off etcd (Kubernetes Architecture).

Managed Services#

• Ably: a realtime pub/sub service whose building block is the channel, multiplexed over one WebSocket per client, for pushing messages to connected browsers and devices (Managed Queues & Streaming).
• AGPLv3: the network copyleft license whose protection is that modifications must be shared with a service's users; Grafana moved to it, and Elastic and Redis later returned to it (Open Source & the Clouds).
• Amazon MQ: AWS's managed Apache ActiveMQ (and later RabbitMQ) broker speaking JMS, NMS, AMQP, STOMP, MQTT and WebSocket, single-instance or active/standby across zones, billed in broker-hours (Managed Queues & Streaming).
• Amazon MSK: AWS's managed Kafka, sold as provisioned brokers billed per broker-hour plus storage, or as Serverless billed per cluster-hour and partition (Managed Queues & Streaming).
• Apache Software Foundation: the foundation that holds Kafka and Pulsar as Apache 2.0 projects owned by the foundation rather than by a company that could relicense them (Open Source & the Clouds).
• APM: Datadog's application performance monitoring product, priced per host alongside Infrastructure (Observability Platforms).
• Aurora Capacity Units (ACU): the unit Aurora Serverless v2 scales in, in steps of 0.5, where one ACU is about 2 GiB of memory with matching CPU and network (Managed Databases).
• Aurora DSQL: AWS's distributed SQL answer to Spanner with PostgreSQL compatibility, an engine that only a provider controlling the hardware and network can sell (Managed Databases).
• AWS CloudWatch: AWS's built-in monitoring, billed per metric-month, per GB of logs, per alarm and per dashboard on the AWS invoice (Observability Platforms).
• Azure Event Hubs: Azure's log service, selling capacity by tier as throughput units, processing units or dedicated capacity units, with retention that lengthens on higher tiers (Managed Queues & Streaming).
• Azure Monitor: Microsoft's built-in monitoring, priced per GB ingested into Log Analytics with commitment tiers and retention charges (Observability Platforms).
• Azure Service Bus: the enterprise broker as a service: queues, topics whose subscriptions carry filter rules, sessions for FIFO and request/response, scheduled delivery, deferral and duplicate detection (Managed Queues & Streaming).
• Backups and point-in-time recovery: a daily snapshot plus continuously shipped transaction logs, which let a managed database be restored to any second within the retention window (Managed Databases).
• Bookies: the storage nodes of a BookKeeper cluster, which hold each Pulsar topic as a series of append-only ledgers while the brokers stay stateless (Managed Queues & Streaming).
• Bookmark: the token each D1 query carries under the Sessions API, so a replica serves a version at least as new as the session has seen, giving sequential consistency per session (Serverless & Edge Databases).
• BSL (Business Source License): a source-available license that allows non-production use, lets the licensor set an Additional Use Grant, and converts to a named open-source license on its Change Date or after four years (Open Source & the Clouds).
• BYOC (bring your own cloud): a deployment in which the provider's cluster runs in the customer's own cloud account, so the provider bills its fee while the customer's cloud bills the infrastructure (Managed Queues & Streaming).
• Capacity units (Event Hubs): single-tenant capacity sold on the Dedicated tier of Azure Event Hubs (Managed Queues & Streaming).
• Cardinality: the number of distinct series a metric produces across its tag values, measured hourly per metric and tag key so a bill spike can be traced to the tag that caused it (Observability Platforms).
• Cells: groups of brokers spread across zones to which Confluent's Kora pins tenants, bounding how far one tenant's load reaches (Managed Queues & Streaming).
• CKU (Confluent Kafka Unit): Kora's capacity abstraction, with bandwidth, request and connection limits that are comparable across clouds (Managed Queues & Streaming).
• Cloud-native monitoring: monitoring built into a cloud (CloudWatch, Azure Monitor, Google Cloud Observability), already collecting that cloud's signals and billed on its invoice (Observability Platforms).
• Cloud-native relational: a familiar relational engine on the provider's own storage (Aurora, AlloyDB, Azure Hyperscale), with fast failover in exchange for storage no other host offers (Managed Databases).
• Cloudflare D1: SQLite as a service with a single primary and asynchronous read replicas, billed by rows read, rows written and storage, with a per-database size ceiling that pushes customers toward many small databases (Serverless & Edge Databases).
• Cloudflare Queues: Cloudflare's queue, delivering at least once to a consumer Worker and billing per 64 KB operation (Managed Queues & Streaming).
• CNCF: the Cloud Native Computing Foundation, part of the Linux Foundation, which holds Kubernetes, Prometheus, OpenTelemetry, NATS and OpenTofu (Open Source & the Clouds).
• Collection: the first stage of an observability pipeline (an agent on each host, an SDK in each process, or a cloud's own emitters), where host counts come from and where data can be sampled or dropped before billing (Observability Platforms).
• Compute-unit hours: Neon's pricing unit for compute, with plans that cap the compute size and bill each CU-hour used (Serverless & Edge Databases).
• Custom metrics: Datadog metrics the customer defines, included per host up to an allotment and billed beyond it, with each tag combination counting as a separate metric (Observability Platforms).
• Database branch: a copy of a serverless database at a point in history with its own endpoint, compute, quota and bill, modeled as a resource with a parent, a creator and an expiry (Serverless & Edge Databases).
• Dead-letter queue: the queue a message moves to after a configured number of failed attempts; target and attempt count are a pair, and each move is an event the customer can alert on (Managed Queues & Streaming).
• Delayed open source: licenses (BSL, FSL) that restrict competing services until a change date and then convert to an open-source license (Open Source & the Clouds).
• Delivery semantics: a queue's guarantee, stored as a column (at least once, deduplicated with its window, or transactional), so documentation, console and support state exactly what was sold (Managed Queues & Streaming).
• Deno KV: a key-value store backed by FoundationDB in production, offering strong or eventual consistency per read and billed in read and write units (Serverless & Edge Databases).
• Diskless Topics: KIP-1150, led by Aiven and accepted by the Kafka community, which keeps topic data in object storage with no broker replication (Managed Queues & Streaming).
• Distributed Processing Units (DPU): the unit Aurora DSQL bills reads and writes in, alongside storage (Managed Databases).
• Distributed SQL: the provider's own engine replicated across zones or regions with strong consistency (Spanner, DSQL, Cosmos DB), and with no other host to move to (Managed Databases).
• Durable Objects: Cloudflare's single-threaded actors, each with a globally unique name, one location and strongly consistent SQLite storage, for state such as a game session, a rate limiter or a document being edited (Serverless & Edge Databases).
• DynamoDB: AWS's fully managed key-value database, descended from the Dynamo paper, whose original pricing unit was provisioned throughput per table (Managed Databases).
• Dynatrace Platform Subscription: an annual platform-level commitment drawn down at rate-card prices, with overage at the same rates (Observability Platforms).
• Edge key-value: keys and values cached or replicated globally (Workers KV, Deno KV, Upstash): simple, global and cheap to read, with eventual consistency as the usual cost (Serverless & Edge Databases).
• Embedded replicas: Turso's feature that serves reads from a local replica inside the application's own process while writes go to the cloud primary (Serverless & Edge Databases).
• engine_versions: the table that holds the engine support calendar (end of standard and extended support, the forced-upgrade date, the target version) with the date each was announced (Managed Databases).
• Enhanced fan-out: a Kinesis option that gives each registered consumer its own per-shard read throughput pushed over HTTP/2, instead of sharing the shard's read limit (Managed Queues & Streaming).
• Event bus: rule-based routing of events (EventBridge, Event Grid), with native events from the cloud's own services and a per-event cost (Managed Queues & Streaming).
• Event-based SaaS: observability on wide events with columnar queries (Honeycomb), with no cardinality penalty and fast ad hoc questions (Observability Platforms).
• EventBridge: AWS's event bus: events from AWS services, SaaS partners and the customer's own code are matched against rules and routed to targets (Managed Queues & Streaming).
• Fair queues: an SQS feature that uses MessageGroupId on standard queues so one queue can be shared among many tenants without one starving the rest (Managed Queues & Streaming).
• FIFO queues: SQS queues that add exactly-once processing with a MessageDeduplicationId and per-group ordering by MessageGroupId (Managed Queues & Streaming).
• Forced upgrade: the provider announcing a date and upgrading whatever engine versions are left in a maintenance window, which is what the end of extended support becomes (Managed Databases).
• Full-stack SaaS: observability platforms (Datadog, New Relic, Dynatrace) that take agents or OTLP and integrate everything, at a bill driven by hosts, bytes and series (Observability Platforms).
• Functional Source License (FSL): Sentry's fixed-term version of the BSL, permitting anything except a "Competing Use," with each release converting to open source after two years (Open Source & the Clouds).
• Google Cloud Observability: Google's built-in monitoring, billed per GiB of logs, per MiB of metrics, per million Prometheus samples and per million spans (Observability Platforms).
• Google Cloud Pub/Sub: one Google service for queues, fan-out and short-retention logs, where a topic has subscriptions that each act as a queue, billed by bytes rather than requests (Managed Queues & Streaming).
• Grafana Cloud: Grafana Labs' managed open-source observability stack, priced by active series for metrics and by GB processed, written and retained for logs, traces and profiles (Observability Platforms).
• Hard-fail limit: a free-tier limit that makes queries fail when reached (as with D1, KV and Hyperdrive), trading a surprise bill for an outage the customer may not have planned for (Serverless & Edge Databases).
• Head sampling: deciding whether to keep a trace at its start, for example by trace-ID ratio; cheap and consistent, but unable to keep every trace with an error (Observability Platforms).
• High availability (Multi-AZ): a hot standby in a second zone fed by synchronous replication, with DNS flipped to it on failure (Managed Databases).
• Honeycomb: an event-based observability platform built for high-cardinality queries, priced by events per month with unlimited seats and custom fields (Observability Platforms).
• Hyperdrive: Cloudflare's service that places a connection pool in regions closest to the origin database and caches non-mutating query results for Workers (Serverless & Edge Databases).
• I/O-Optimized: an Aurora cluster configuration with no per-I/O charge and higher instance and storage rates, for customers who can't forecast I/O (Managed Databases).
• Idle cost: what a database bills when nobody uses it; idle D1 costs nothing, idle Turso only storage and suspended Neon compute nothing, against a provisioned instance billing every hour (Serverless & Edge Databases).
• Inactivity pause: a free project suspended after a period without activity (Supabase after a week, Neon compute after minutes), modeled as a resource in a stopped state (Serverless & Edge Databases).
• Infrastructure (Datadog): Datadog's per-host monitoring product, in Pro and Enterprise tiers that include a pooled allotment of custom metrics (Observability Platforms).
• Ingest: the observability stage where the platform's endpoint receives telemetry, applies the customer's drop and transformation rules, and meters what remains, which makes the rules a pricing feature (Observability Platforms).
• Ingest versus index: the split every observability platform converged on, billing data received separately from data indexed for query so customers can keep data they rarely read cheaply (Observability Platforms).
• Input gates: the Durable Objects mechanism that delivers no new events to an object while its storage operations run, making a single-threaded object correct without locks (Serverless & Edge Databases).
• Instance class: the vCPU and memory size a customer picks when provisioning a managed database, along with storage type and size, engine version and network placement (Managed Databases).
• Kafka-compatible engines: engines that speak the Kafka protocol on a different implementation (Redpanda, WarpStream, Event Hubs, Ursa), for simpler operations or object-storage economics (Managed Queues & Streaming).
• Kinesis Data Streams: AWS's managed log for real-time streaming data, whose unit of capacity is the shard (Managed Queues & Streaming).
• Kora: Confluent's multi-tenant Kafka engine, with tiered storage, CKUs, tenants pinned to cells and dynamic quotas (Managed Queues & Streaming).
• Ledgers: the append-only segments in which BookKeeper stores each Pulsar topic, with sealed segments copied to object storage by tiered storage (Managed Queues & Streaming).
• libSQL: an open-contribution, MIT-licensed fork of SQLite that keeps the single-writer model and adds embedded replicas and remote access (Serverless & Edge Databases).
• Linux Foundation: the foundation where the forks from the relicensing fights landed (Valkey, OpenTofu, the OpenSearch Software Foundation), so no single company can relicense them (Open Source & the Clouds).
• LiteFS: Fly.io's open-source replicated SQLite, running in production but pre-1.0 and offered without support (Serverless & Edge Databases).
• Log (messaging): a shape in which any consumer reads messages at its own offset and messages are kept until retention expires, ordered per partition or shard (Kafka, Kinesis, Event Hubs) (Managed Queues & Streaming).
• Log is the database: Aurora's design principle that only redo log records cross the network, with storage nodes producing pages from them in the background and on demand (Managed Databases).
• Maintenance window: the weekly window a customer picks for minor-version patches and OS updates, with a failover to the standby on Multi-AZ, and forced application when the provider deems a patch mandatory (Managed Databases).
• Managed broker: a protocol broker run for the customer (Amazon MQ, CloudAMQP, Service Bus Premium), speaking AMQP, JMS or MQTT for existing applications (Managed Queues & Streaming).
• Managed Kafka: a provisioned or serverless Kafka log run by a provider (Confluent, MSK, Aiven), offering replay, retention and the Kafka ecosystem (Managed Queues & Streaming).
• Managed key-value: a partitioned key-value store, provisioned or on-demand (DynamoDB), with predictable latency at any scale and no servers to run (Managed Databases).
• Managed open-source engine: a provider-run open-source engine on attached storage (RDS, Cloud SQL, Flexible Server, Aiven, DigitalOcean), the portable middle option (Managed Databases).
• Managed open-source stack: a vendor running open-source observability engines (Grafana Cloud, Elastic Cloud), so data formats stay open (Observability Platforms).
• Messaging unit: the hourly capacity unit of Azure Service Bus Premium, bought in fixed sizes with no per-operation charge (Managed Queues & Streaming).
• Metal: PlanetScale's databases on locally attached NVMe drives with unlimited I/O, at the cost of fixed-size drives that go read-only when full until resized (Serverless & Edge Databases).
• Metrics without Limits: Datadog's split of metric billing into tag combinations ingested and tag combinations indexed for query, so customers can send fine-grained tags without indexing them all (Observability Platforms).
• NATS: a light, fast, edge-friendly messaging system of subjects plus JetStream for persistence, sold by Synadia or self-hosted (Managed Queues & Streaming).
• Neki: PlanetScale's Postgres sharding system, built by the Vitess team and not a fork of Vitess (Serverless & Edge Databases).
• Neon: serverless Postgres with storage separated from compute, billed in compute-unit hours and GB-months of storage (Serverless & Edge Databases).
• Network copyleft: licenses (AGPLv3) that allow running the software as a service but require a modified version to offer its source to users interacting with it remotely (Open Source & the Clouds).
• Nile: Postgres that virtualizes tenants inside one database, each functioning as its own virtual database without Row Level Security (Serverless & Edge Databases).
• Non-compete source-available: licenses (RSALv2, Elastic License 2.0, Confluent Community License, BSL with an Additional Use Grant, FSL) that forbid offering the software as a competing service (Open Source & the Clouds).
• Open core: an open edition of the engine plus a commercial edition with paid features, which protects the features but not the engine (Open Source & the Clouds).
• OpenSearch: AWS's fork of Elasticsearch 7.10 after Elastic's 2021 relicensing, now held by the OpenSearch Software Foundation under the Linux Foundation (Open Source & the Clouds).
• OpenSSF: the Open Source Security Foundation, which holds OpenBao, the Vault fork, for the security and continuity of critical projects (Open Source & the Clouds).
• OSI: the Open Source Initiative, whose position is that source-available licenses are not open source and "fauxpen" labels mislead (Open Source & the Clouds).
• Output gates: the Durable Objects mechanism that holds outgoing messages until a write completes, so no client sees a result that could still be lost (Serverless & Edge Databases).
• Pageserver: the Neon component that materializes page versions from base images plus WAL, asynchronously, and serves pages to compute on request (Serverless & Edge Databases).
• Permissive license: licenses (MIT, BSD-3, Apache 2.0) that allow running the software as a service for others with no obligation to share changes (Open Source & the Clouds).
• Pipelines (telemetry): components that drop, aggregate and route telemetry before it is billed, such as the OpenTelemetry Collector, Grafana Alloy and Chronosphere's Telemetry Pipeline (Observability Platforms).
• PlanetScale: managed MySQL (on Vitess) and Postgres priced by cluster size per month, with a Metal option on local NVMe (Serverless & Edge Databases).
• Processing units (Event Hubs): the Premium-tier capacity unit of Azure Event Hubs, isolated at the CPU and memory level (Managed Queues & Streaming).
• Product retirement: a provider ending an entire deployment option, as Azure did with Azure Database for MySQL Single Server, so every customer on it must migrate (Managed Databases).
• Protection group: a 10 GB Aurora storage segment replicated six ways, small enough to repair quickly so a second failure rarely hits the same segment (Managed Databases).
• Provisioned throughput: DynamoDB's original pricing and isolation unit, in which customers specify the request capacity a table needs and the service reserves it (Managed Databases).
• Provisioned versus used storage: the meter choice between billing what a customer allocated (RDS) and what it consumes (Aurora), which decides whether deleting a table lowers the bill (Managed Databases).
• Pub/sub topic or bus: a shape that delivers each message to every subscription, each of which then acts as a queue (SNS, EventBridge, Pub/Sub) (Managed Queues & Streaming).
• Pulsar: a messaging system of stateless brokers over BookKeeper storage that offers queue and log semantics in one, with multi-tenancy built into topic names (Managed Queues & Streaming).
• Pusher: a realtime pub/sub service (Pusher Channels) sold by daily message and concurrent-connection allowances (Managed Queues & Streaming).
• Query (observability): the stage of dashboards, alerts and ad hoc queries, which some platforms bill directly, for example by data scanned (Observability Platforms).
• Queue: a shape in which each message goes to one of many competing consumers and is deleted once processed (SQS, Service Bus queues, RabbitMQ queues, Cloudflare Queues) (Managed Queues & Streaming).
• Queue in the application's database: a jobs table read with SKIP LOCKED, which adds no new system and enqueues transactionally, at limited throughput (Managed Queues & Streaming).
• R2: Cloudflare's S3-compatible object storage with no egress fee, which Workers read as a data source (Serverless & Edge Databases).
• RabbitMQ under Broadcom: RabbitMQ kept its Mozilla Public License 2.0, and what changed under Broadcom was support, with core-team support limited to commercial customers and contributors and each release given an End of Community Support date (Managed Queues & Streaming).
• RDS Extended Support: a paid option to keep running a major engine version past the end of standard support for a limited time, after which the provider upgrades the database itself (Managed Databases).
• Read replicas: asynchronous copies of a managed database for read scaling, each a separately billed instance, with replica lag the customer has to handle (Managed Databases).
• Realtime channel: a shape that delivers messages to connected clients subscribed to a channel, kept only for a short history (Ably, Pusher) (Managed Queues & Streaming).
• Redpanda: a Kafka-compatible engine under the Business Source License, whose Additional Use Grant forbids offering a competing streaming or queueing service (Managed Queues & Streaming).
• Safekeepers: the Neon nodes that replicate the write-ahead log with Paxos; a transaction commits once a quorum of safekeepers acknowledges its WAL record (Serverless & Edge Databases).
• series_counts: the table written hourly per metric name with the distinct count per tag key, so a bill increase can be explained by the tag that caused it (Observability Platforms).
• Serverless Postgres: Postgres with separated storage or managed plans (Neon, Supabase, PlanetScale, Xata) that can scale to zero (Serverless & Edge Databases).
• Service-source license: licenses (SSPL) that allow running the software as a service only if the provider releases the source of its whole service stack (Open Source & the Clouds).
• Shard: the unit of Kinesis capacity, with fixed write and read throughput limits per shard (Managed Queues & Streaming).
• SNS: AWS's fan-out service, where a publish to a topic is delivered to every subscription (SQS queues, Lambda functions, HTTP endpoints, email, Firehose) (Managed Queues & Streaming).
• Spanner: Google's globally distributed, synchronously replicated database, the first to offer externally consistent distributed transactions at global scale through an API that exposes clock uncertainty (TrueTime) (Managed Databases).
• SQLite as a service: one file per database with a single writer and replicas (D1, Turso), which makes many small databases nearly free (Serverless & Edge Databases).
• SSPL (Server Side Public License): MongoDB's license whose Section 13 requires anyone offering the program as a service to release the source of the whole service stack, in practice a cloud's control plane; internal use is not a service (Open Source & the Clouds).
• Standard queues: SQS queues that deliver at least once, possibly more than once, with best-effort ordering and nearly unlimited throughput (Managed Queues & Streaming).
• Storage tiers (observability): where telemetry is kept by kind: metrics in a time-series database keyed by series, logs in a search index or a cheaper archive, traces and events in their own stores (Observability Platforms).
• Supabase: Postgres plus REST, auth, realtime and storage around it, priced as a plan plus compute add-ons, disk, monthly active users and egress (Serverless & Edge Databases).
• Tail sampling: deciding whether to keep a trace after seeing most of its spans, so errors and slow traces are kept; stateful and harder to run than head sampling (Observability Platforms).
• Throughput unit (Event Hubs): the Basic and Standard tier capacity unit of Azure Event Hubs, with fixed ingress and egress limits per unit (Managed Queues & Streaming).
• Trademark policy: protecting a project's name regardless of its license, which proved decisive for Elastic and NATS but needs registration and enforcement (Open Source & the Clouds).
• Turso: SQLite (libSQL) as a service with embedded replicas in the application, read-your-writes for the writer and sync for others (Serverless & Edge Databases).
• Upstash: a vendor of Redis-protocol storage priced per command and reachable over HTTP from functions that can't hold a TCP connection (Serverless & Edge Databases).
• Upstash QStash: serverless messaging and scheduling that sits between a producer and an API: QStash calls the destination URL, retries on failure, and supports delays and cron schedules (Managed Queues & Streaming).
• Upstash Redis: a serverless Redis-protocol store reached over HTTP or TCP, per region with read regions, billed by commands, storage and bandwidth (Serverless & Edge Databases).
• Upstash Vector: Upstash's per-request vector index product (Serverless & Edge Databases).
• Ursa: StreamNative's Kafka-compatible data streaming engine built on lakehouse storage (Managed Queues & Streaming).
• Valkey: the Linux Foundation fork of Redis launched after Redis left the BSD license, which AWS and Google ship at lower prices than their Redis caches (Open Source & the Clouds).
• Vendor's own cloud: the engine's maker running it on a hyperscaler (MongoDB Atlas), giving the real engine and newest versions across clouds (Managed Databases).
• Visibility timeout: the SQS lease that hides a received message while the consumer works on it; if the message isn't deleted before it expires, it becomes visible again for redelivery (Managed Queues & Streaming).
• WarpStream: a Kafka-compatible engine, bought by Confluent, that writes directly to S3 from agents in the customer's own cloud account, avoiding stateful brokers and broad vendor access to that account (Managed Queues & Streaming).
• Weak copyleft: licenses (MPL 2.0) that allow running the software as a service but require a covered file distributed in executable form to be made available as source (Open Source & the Clouds).
• Workers KV: Cloudflare's global key-value store cached at the edge, eventually consistent with a stated propagation delay, billed by reads, writes and GB-month (Serverless & Edge Databases).
• Xata: a managed Postgres platform built on copy-on-write branching, with anonymized production clones, branches that hibernate when idle, and a provisioning API for platforms (Serverless & Edge Databases).

Deployment#

• Active CPU: a platform meter that accrues only while code is executing and pauses during I/O, so a function waiting on a database costs little (PaaS & Frontend Clouds).
• Blue/green deployment: running a new version beside the old and switching traffic at once; on platforms an immutable deployment with its own URL is a green environment that already exists, and promotion is the routing change (Platforms Take Over the Deploy).
• Build, release, run: the twelve-factor split that is a platform's data model: a build is the artifact from a commit, a release is that build plus a specific configuration, and run is processes started from a release (Platforms Take Over the Deploy).
• Buildpacks: the platform's way of turning source into a runnable artifact without a Dockerfile: detect the language, install the runtime and dependencies, compile and produce something the platform can start (Platforms Take Over the Deploy).
• Canary release: shifting a small share of traffic to a new version before the rest, sold by platforms as percentage traffic weights on slots, revisions or aliases (Platforms Take Over the Deploy).
• Capistrano: a deploy tool that scripts SSH to many servers to check out and build a release directory, link shared files and switch a symlink, so rollback moves the pointer (How Code Got to Servers).
• Classic PaaS: platforms such as Heroku, Render and App Engine standard that run processes from source in fixed sizes per month or hour, simple but priced well above the underlay (PaaS & Frontend Clouds).
• Frontend cloud: platforms such as Vercel, Netlify and Cloudflare Pages serving static assets, functions and previews on a CDN, billed by plan plus metered CPU, memory, requests and bandwidth (PaaS & Frontend Clouds).
• FTP: the original file upload protocol (RFC 959) over separate cleartext control and data connections, with cleartext credentials and partial uploads served live (How Code Got to Servers).
• FTP account (control panel): an additional login an account holder creates in the panel, confined to one directory, whose maximum number is a package limit (How Code Got to Servers).
• FTPS: FTP with TLS on both channels (RFC 4217), which fixed the cleartext password but kept the two-connection design that troubles firewalls (How Code Got to Servers).
• GitOps: the practice of keeping desired state in Git with an agent that pulls and reconciles it, so a deploy is a merged commit rather than a push from CI, and CI holds no production credentials (Platforms Take Over the Deploy).
• Hyperscaler PaaS: containers or code run on a cloud's own capacity (App Runner, Cloud Run, Azure App Service), with no reseller margin and the same bill and IAM as the rest of that cloud (PaaS & Frontend Clouds).
• Image push: a deploy where the customer builds an OCI image and the platform runs it, giving the same artifact everywhere while the customer owns base-image patching (Platforms Take Over the Deploy).
• Immutable deployment URL and alias: the model in which every deploy gets a unique, permanent URL and a stable domain is an alias pointing at one, so promotion, rollback and previews are alias moves (Platforms Take Over the Deploy).
• Invocations: a platform meter counting requests, alongside Active CPU and Provisioned Memory (PaaS & Frontend Clouds).
• Isolate platforms: platforms such as Cloudflare Workers that run code in V8 isolates everywhere, billed by requests and CPU time with runtime limits (PaaS & Frontend Clouds).
• Machine platforms: platforms such as Fly.io and Railway selling per-second VMs or containers with platform deploys, close to cloud prices with more operations left to the customer (PaaS & Frontend Clouds).
• Panel file manager: browser-based file operations inside a hosting account, needing no client but editing production directly, with the panel session as the credential (How Code Got to Servers).
• Preview deployment: a deployment of every pull request or non-production branch to its own URL, updated on each push and linked from the pull request, turning review into using the change (Platforms Take Over the Deploy).
• Procfile: a file in the repository naming an app's process types (web, worker, clock) and the command for each, Heroku's process model (Platforms Take Over the Deploy).
• Provisioned Memory: a platform meter that accrues GB-hours for an instance's lifetime until its last in-flight request finishes (PaaS & Frontend Clouds).
• Release directory: the deploy pattern of building each release in a new directory and switching a pointer to it, which made a deploy atomic and rollback instant, unlike copying into the served directory (How Code Got to Servers).
• rsync: a delta-transfer tool over SSH or its own daemon that moves only changed blocks, cheap for mirroring a release to many servers but updating in place unless paired with release directories (How Code Got to Servers).
• Scripted push from CI: a pipeline that runs deploy commands with production credentials, working anywhere but making CI a production credential holder (Platforms Take Over the Deploy).
• SFTP: the SSH File Transfer Protocol, file transfer inside one SSH channel with one port and key authentication, chrootable but never an RFC and still not atomic (How Code Got to Servers).
• Slots and revisions: named or numbered versions of an app with traffic weights (Azure App Service slots, Cloud Run revisions, Lambda aliases), giving percentage canaries inside one product (Platforms Take Over the Deploy).
• Source push: a deploy where the platform detects, builds and runs the customer's source with buildpacks, needing no build configuration but with opaque builds (Platforms Take Over the Deploy).
• Spend cap: a platform's limit on metered spend with an explicit action at the threshold (notify, pause production, pause everything); platform caps pause the customer's site, the opposite of a hyperscaler's alert-only default (PaaS & Frontend Clouds).
• Spin-down: a free tier's practice of stopping a service after a period without inbound traffic, because the platform pays for warm capacity (PaaS & Frontend Clouds).
• Twelve-Factor App: Heroku's written contract for apps (one codebase, declared dependencies, config in the environment, backing services as resources, separate build, release and run, stateless processes and more), whose factor five is a platform's data model (Platforms Take Over the Deploy).

CI/CD Platforms#

• 24-hour lease (macOS): Apple's license term allowing Apple hardware to be leased for developer services only for at least 24 consecutive hours to one lessee, which is why hosted macOS minutes carry idle cost (Runners & Build Infrastructure).
• Actions Runner Controller (ARC): the Kubernetes way to run ephemeral GitHub Actions runners, a community project that became a GitHub project and gained a runner scale sets mode (Runners & Build Infrastructure).
• Amazon ECR: AWS's container registry, billed for storage and internet egress with same-region transfer free (Artifacts & Registries).
• Argo CD and Argo Rollouts: CNCF Kubernetes delivery tools that treat Git as desired state and run blue/green and canary rollouts with metric analysis and automatic promotion or rollback (Continuous Delivery Platforms).
• AWS CodeBuild: AWS's build service, with container-based build environments, Lambda compute and reserved capacity (including Mac), billed per minute by compute type (Runners & Build Infrastructure).
• AWS CodeDeploy: AWS's deployment service, based on Amazon's internal Apollo, doing rolling updates with health checks and automatic rollback, gated through CodePipeline stages (Continuous Delivery Platforms).
• Azure Pipelines: CI from Microsoft's Azure DevOps suite for any repository, priced by parallel jobs with unlimited minutes (From Tinderbox to Jenkins: How CI Began).
• Azure Pipelines environments: Azure DevOps environments whose approvals and checks sit on the resource being deployed to, with deployment strategies in YAML (Continuous Delivery Platforms).
• Bamboo: Atlassian's licensed CI server, whose hosted Bamboo Cloud was discontinued and whose Data Center edition has a scheduled end of life (From Tinderbox to Jenkins: How CI Began).
• Bitbucket Pipelines: Atlassian's CI built into the Bitbucket code host, billed in build minutes scaled by runner size (From Tinderbox to Jenkins: How CI Began).
• Branch rules: an environment protection that limits which branches or tags may deploy to an environment, such as protected branches only (Continuous Delivery Platforms).
• Buildkite: CI sold as the hybrid model: a SaaS control plane with customer-run agents, so source code and secrets stay in the customer's infrastructure (Runners & Build Infrastructure).
• Bypass (deployment gate): an administrator overriding an environment's approvals or checks; Azure Pipelines shows the bypass, and the playbook logs every one (Continuous Delivery Platforms).
• CircleCI: independent hosted CI that later added self-hosted runners, priced in credits per minute by resource class (From Tinderbox to Jenkins: How CI Began).
• CloudBees: the commercial Jenkins company (The CI/CD Platform Business).
• Code-host CI: CI built into where the code lives (GitHub Actions, GitLab CI, Bitbucket Pipelines, Azure Pipelines), the kind of hosted CI that mostly survived (From Tinderbox to Jenkins: How CI Began).
• Codecov Bash Uploader: the 2021 incident in which a credential exposed by a Docker image build let attackers modify a script that sent CI environment variables out, which argued for short-lived credentials and rotating everything in CI (Pipeline Supply-Chain Security).
• Cost factors: pricing (GitLab, Bitbucket) that expresses each machine type as a multiple of a base minute drawn from the plan's quota (The CI/CD Platform Business).
• Credits (CI): a single currency the customer buys in packs and spends per minute by resource class (CircleCI, Travis), which lets the vendor reprice a class without changing the pack price (The CI/CD Platform Business).
• CruiseControl: ThoughtWorks' open-source build loop that polled version control, an early CI server (From Tinderbox to Jenkins: How CI Began).
• Custom deployment protection rules: GitHub's external checks that let a third-party service approve or reject a deployment to an environment (Continuous Delivery Platforms).
• Cyber Resilience Act (CRA): the EU regulation that phases in vulnerability and incident reporting for manufacturers and an Annex I requirement to document components, including a machine-readable SBOM (Pipeline Supply-Chain Security).
• Digest: the immutable content address of an image, which deployments should reference because tags move, and which tells a retention policy what is in use (Artifacts & Registries).
• Docker Build Cloud: Docker's hosted build service, with build minutes included in Docker plans and no on-demand overage (The CI/CD Platform Business).
• Docker Hub: Docker's public registry, which rate-limits pulls per account and, for anonymous traffic, per IPv4 address or IPv6 /64 (Artifacts & Registries).
• Ephemeral runner: a runner that gets a machine nobody used before and nobody uses after, the default for hosted jobs and the rule whenever the code is untrusted (Runners & Build Infrastructure).
• Executive Order 14028: the US order that tasked NIST with software supply chain guidance, with SBOMs among the workstreams (Pipeline Supply-Chain Security).
• Firecracker microVM: a lightweight VM per job that gives Docker a VM boundary, the alternative to mounting the host's Docker socket or running privileged Docker-in-Docker (Runners & Build Infrastructure).
• Flag service: releasing by feature flag rather than deploy (LaunchDarkly, OpenFeature providers), with per-user rollout and an instant kill switch; a flag flip is a release (Continuous Delivery Platforms).
• Fulcio: Sigstore's certificate authority, which issues short-lived certificates bound to an OIDC identity (Pipeline Supply-Chain Security).
• GhostAction: an incident in which workflows were pushed into repositories with stolen maintainer access to post secrets out, which argued for branch protection on workflow files and short-lived tokens (Pipeline Supply-Chain Security).
• GitHub Actions: workflows in the GitHub code host, run on hosted or self-hosted runners and priced per minute by OS and size (From Tinderbox to Jenkins: How CI Began).
• GitHub Container Registry (GHCR): GitHub's registry at ghcr.io, private by default, with storage and bandwidth "currently free" (Artifacts & Registries).
• GitHub environments: Actions' deployment targets carrying required reviewers, a wait timer, branch rules and custom protection rules, set outside the workflow file (Continuous Delivery Platforms).
• GitLab CI: CI built into the GitLab code host, run on runners (From Tinderbox to Jenkins: How CI Began).
• GitLab protected environments: GitLab environments that restrict deployment, with deployment approvals on Premium and Ultimate (Continuous Delivery Platforms).
• GitLab Runner autoscaling: GitLab's runner autoscaling through Fleeting, a plugin-based abstraction over a cloud's instance groups, driven by the Docker Autoscaler and Instance executors (Runners & Build Infrastructure).
• Google Artifact Registry: Google's registry, the successor to Container Registry, whose shutdown forced a registry migration on customers (Artifacts & Registries).
• Google Cloud Build: Google's per-minute cloud build service (The CI/CD Platform Business).
• Hudson, then Jenkins: the open-source CI server with plugins, renamed Jenkins after a trademark dispute; Jenkins sits under the Continuous Delivery Foundation and Hudson went to Eclipse (From Tinderbox to Jenkins: How CI Began).
• Hybrid model: self-hosted runners on a SaaS control plane: the customer owns hardware, network and cost while the vendor runs orchestration, and platform fees can appear (The CI/CD Platform Business).
• Independent hosted CI: hosted CI sold by a vendor that isn't the code host (CircleCI, Travis CI, Buildkite), selling speed and features and working with several code hosts (From Tinderbox to Jenkins: How CI Began).
• JFrog Artifactory: JFrog's universal repository for many package formats, self-hosted or cloud (Artifacts & Registries).
• Keyless signing: signing with short-lived certificates bound to an OIDC identity and recorded in a public log (Sigstore), so there are no signing keys to steal (Pipeline Supply-Chain Security).
• Kubernetes reconciler: continuous delivery with Git as desired state and controllers for rollout strategies (Argo CD and Rollouts), with no CD server and built-in drift correction (Continuous Delivery Platforms).
• Licensed server: a commercially licensed CI server with build agents (TeamCity, Bamboo Data Center), with vendor support and vendor end-of-life risk (From Tinderbox to Jenkins: How CI Began).
• OIDC federation: a CI job exchanging a signed platform token describing itself for short-lived cloud credentials under a trust policy, so no long-lived cloud keys sit in the CI secret store (Pipeline Supply-Chain Security).
• Parallel jobs: pricing (Azure Pipelines) that sells concurrency, unlimited minutes per job slot, so the bill is fixed and slow builds cost waiting instead (The CI/CD Platform Business).
• Per-minute SKUs: pricing (GitHub, CodeBuild, Cloud Build) that prices each machine type separately and rounds each job up to a whole minute, a rounding that is part of the margin (The CI/CD Platform Business).
• Pull accounting: a registry counting manifest requests per principal and, for anonymous traffic, per IPv4 address or IPv6 /64, in a sliding window; layer caches don't reduce the count (Artifacts & Registries).
• Pull-through cache: a local mirror of an upstream registry that avoids rate limits and egress and survives upstream outages, at the risk of a stale or poisoned cache (Artifacts & Registries).
• Rekor: Sigstore's public transparency log, which lets a consumer verify that an artifact was signed by a given workflow at a given time (Pipeline Supply-Chain Security).
• Remote execution: distributing and caching build actions across many machines over Bazel's Remote Execution API, where a cache hit skips work; it needs hermetic builds (Runners & Build Infrastructure).
• Retention policies (registry): rules that delete untagged manifests after a period and keep the newest N tags per repository, never deleting digests pinned by a running deployment (Artifacts & Registries).
• Runner labels: the scheduler's interface: jobs ask for labels such as linux, arm64 or gpu, and the control plane matches them to runners that advertise them (Runners & Build Infrastructure).
• SBOM (software bill of materials): a component inventory per build that answers "are we affected" fast and supports CRA compliance (Pipeline Supply-Chain Security).
• Self-approval: a person approving a deployment they started, which GitHub environments can prevent and GitLab disallows by default (Continuous Delivery Platforms).
• Self-hosted runners: the customer's machines running the vendor's agent, which polls the control plane for jobs, giving the customer its own hardware, network and cost (Runners & Build Infrastructure).
• Self-run OCI registry: registry software (Distribution, Harbor) on the operator's own storage, with full control and no rate limits but storage, garbage collection and availability to run (Artifacts & Registries).
• Self-run open-source server: a CI server the customer runs (Jenkins), running any workflow through plugins with no per-minute cost, at the price of plugin sprawl and upgrades (From Tinderbox to Jenkins: How CI Began).
• SHA pinning: referencing actions by commit rather than tag, enforced by organization policy, so a moved tag can't reach the workflow (Pipeline Supply-Chain Security).
• Shai-Hulud: a self-replicating npm worm that stole tokens and republished victims' packages; its second wave registered infected hosts as self-hosted runners (Pipeline Supply-Chain Security).
• Signed provenance: the build platform signing a statement of what it built and how, so consumers can verify origin (Pipeline Supply-Chain Security).
• SLSA: the supply-chain framework whose Build levels run from L0 (none) through L2 (signed provenance from a hosted platform) to L3 (a hardened platform with isolated runs and an unreachable signing secret) (Pipeline Supply-Chain Security).
• SolarWinds (SUNSPOT and SUNBURST): the incident in which malware on the build server swapped one source file during the build and restored it afterward, the case for hardened, isolated builds with provenance (Pipeline Supply-Chain Security).
• Sonatype Nexus Repository: Sonatype's artifact repository, whose free Community Edition has a usage ceiling (Artifacts & Registries).
• Spinnaker: Netflix's open-source multi-cloud continuous delivery tool of pipelines of deployment stages, now under the Continuous Delivery Foundation (Continuous Delivery Platforms).
• TeamCity: JetBrains' licensed CI server with build agents (From Tinderbox to Jenkins: How CI Began).
• Third-party runner vendors: vendors (Depot, Blacksmith, Namespace, Ubicloud, WarpBuild, Actuated) selling faster or cheaper machines registered to the code host as self-hosted runners, tying their business to its terms (Runners & Build Infrastructure).
• Tinderbox: Netscape's release-engineering system of build machines reporting to a status page, the shape every CI system kept: many agents, one coordinator, a result per commit (From Tinderbox to Jenkins: How CI Began).
• tj-actions/changed-files (CVE-2025-30066): the incident in which a popular action's tags were repointed at a commit that dumped secrets into logs, the case for SHA pinning (Pipeline Supply-Chain Security).
• Travis CI: hosted CI that was free for open source on travis-ci.org until that service shut down, later priced in credits (From Tinderbox to Jenkins: How CI Began).
• Trusted publishing: a registry accepting uploads only from a named workflow, exchanging its OIDC token for a short-lived upload token so no publish token is stored (npm, PyPI) (Pipeline Supply-Chain Security).
• Universal repository: one store for every package format plus proxies of public registries (Artifactory, Nexus), bought for governance (Artifacts & Registries).
• Wait timer: a delay an environment imposes before a deployment proceeds, such as GitHub's configurable timer or Azure's business-hours check (Continuous Delivery Platforms).

Infrastructure as Code#

• 22 levels of precedence: the order in which Ansible resolves a variable, from command-line values and role defaults up to extra vars, which always win (Push & Events: Ansible and Salt).
• Account Factory for Terraform (AFT): AWS's pipeline that vends Control Tower accounts from an account request file and applies customizations to all accounts, a set of them or one (Governance, Guardrails & the Resource Catalog).
• Account vending: stamping out a new account, subscription or project through one pipeline that places it in the tree, attaches the baseline and records its owning team (Governance, Guardrails & the Resource Catalog).
• Action (Event-driven Ansible): what a matching rule runs, such as run_playbook, run_module or run_job_template, or posting an event or fact to a ruleset (Push & Events: Ansible and Salt).
• Advisory (policy): Sentinel's default enforcement level, where a failed policy is allowed and logged as a warning (Testing, Policy, Secrets & IaC Platforms).
• Aminator: Netflix's open-source AMI baker, which built an image from a volume created from a base AMI's snapshot, later driven by Netflix's Bakery API (Baking Images: Packer).
• Ancestry (images): HCP Packer's record of each image's parent, used to warn when a child is built on an outdated parent and to cascade revocation (Baking Images: Packer).
• Ansible: push-based configuration management over SSH from a control node, in YAML, with no agent on managed nodes and ordering across hosts built in (Push & Events: Ansible and Salt).
• Ansible Automation Platform: Red Hat's commercial Ansible platform: a job server with RBAC and an API, execution environments and Event-driven Ansible (Push & Events: Ansible and Salt).
• Ansible Galaxy: the public hub from which Ansible collections are installed, alongside private Galaxy-compatible servers (Push & Events: Ansible and Salt).
• ansible-core: Ansible's runtime and CLI (ansible, ansible-playbook), which the ansible package extends with curated community collections (Push & Events: Ansible and Salt).
• ansible-pull: Ansible run in reverse, pulling content from Git on cron, which needs no server but puts credentials on every node and keeps no central record (Push & Events: Ansible and Salt).
• Artifact (Packer): the output of one Packer build, for example the AMI ids in each region (Baking Images: Packer).
• Atlantis: self-hosted, open-source pull-request automation for Terraform that costs nothing but the server, the floor hosted IaC platforms have to justify (Testing, Policy, Secrets & IaC Platforms).
• AWS CDK: AWS's framework for defining infrastructure in general-purpose languages, which synthesizes CloudFormation templates so CloudFormation still does the provisioning (Provisioning: Terraform, OpenTofu & the Alternatives).
• AWS Config: AWS's recorded configuration items per resource, with organization aggregators, rule evaluations and retention up to seven years, the inventory under its detective controls (Governance, Guardrails & the Resource Catalog).
• AWS Control Tower: AWS's landing zone service, generally available June 24, 2019, with an Account Factory and mandatory, strongly recommended and elective controls that don't bind the management account (Governance, Guardrails & the Resource Catalog).
• AWS Controllers for Kubernetes (ACK): one Kubernetes controller per AWS service, managing AWS objects as custom resources on any cluster (Provisioning: Terraform, OpenTofu & the Alternatives).
• AWS OpsWorks: AWS's retired service that provided managed Chef and Puppet servers (Chef).
• AWS Systems Manager State Manager: AWS's cloud-native convergence, where an association applies an SSM document (such as one that runs Ansible playbooks) to tagged nodes on a schedule (Convergence: CFEngine to Puppet).
• AWX: the open-source upstream of Ansible's controller (web UI, REST API and task engine), whose releases are paused during a refactoring (Push & Events: Ansible and Salt).
• Azure Automation State Configuration: Microsoft's built-in PowerShell DSC pull server, from which nodes pull configurations and report compliance (Convergence: CFEngine to Puppet).
• Azure Machine Configuration: configurations assigned through Azure Policy to Azure and Arc-enabled machines and evaluated by the machine's agent (Convergence: CFEngine to Puppet).
• Azure Policy effects: the single effect each Azure Policy definition carries (deny, audit, modify, deployIfNotExists and others), evaluated in a fixed order, with assignments at different scopes combined as cumulative most restrictive (Governance, Guardrails & the Resource Catalog).
• Azure Resource Graph: Azure's KQL-queryable index of resources, policy states and 14 days of changes, updated with short latency but not strongly consistent (Governance, Guardrails & the Resource Catalog).
• Azure VM Image Builder: Azure's managed image-building service built on HashiCorp Packer, driven by image templates (Baking Images: Packer).
• Backends: where Terraform stores and locks the state document, such as the S3 backend with server-side encryption, a KMS key and bucket versioning (Provisioning: Terraform, OpenTofu & the Alternatives).
• Backstage: the software catalog Spotify open-sourced on March 16, 2020, now CNCF Incubating, whose entities live in catalog-info.yaml files beside the code with a required owner on each Component (Governance, Guardrails & the Resource Catalog).
• Baked image: an image with the software and its configuration already in it, which removes drift by construction but makes every change a rebuild (Baking Images: Packer).
• Beacons: Salt monitors run by a minion that fire an event onto the bus when they see something, such as a file change or high load (Push & Events: Ansible and Salt).
• Berkshelf: the tool that managed Chef cookbooks and their dependencies with a Berksfile and a lockfile, before Policyfiles (Chef).
• Bicep / ARM: Azure's DSL compiled to ARM JSON, with service-held state and what-if previews, and new Azure resource types on day one (Provisioning: Terraform, OpenTofu & the Alternatives).
• Bodies: CFEngine's reusable blocks holding the complex attribute sets of promises (Convergence: CFEngine to Puppet).
• Buckets and versions: HCP Packer's registry structure: a bucket per image, and an immutable version for each completed build (Baking Images: Packer).
• Build (Packer): one source run with its provisioners and post-processors; builds in a template run in parallel unless told otherwise (Baking Images: Packer).
• Builder: the Packer plugin component behind a source that creates a machine on one platform and turns it into an image, such as amazon-ebs or googlecompute (Baking Images: Packer).
• Bundles: CFEngine's reusable groups of promises (Convergence: CFEngine to Puppet).
• Catalog: the graph of resources and their relationships that the Puppet server compiles for one node, plain data that keeps other nodes' code and data off the machine (Convergence: CFEngine to Puppet).
• CDKTF: HashiCorp's CDK equivalent that synthesized Terraform configuration from general-purpose languages, since sunset and archived (Provisioning: Terraform, OpenTofu & the Alternatives).
• CFEngine: the original convergence tool, in which an agent on every host pulls policy from a policy server and converges itself on an interval (Convergence: CFEngine to Puppet).
• Changed: the run status for a convergence run that repaired something (Convergence: CFEngine to Puppet).
• Channels: named, movable pointers to image versions in HCP Packer, such as production, so promotion and rollback move a channel while versions stay immutable (Baking Images: Packer).
• Checkov: an Apache-2.0 policy scanner with a large built-in policy set for AWS, Azure and Google Cloud that scans Terraform and other configuration (Testing, Policy, Secrets & IaC Platforms).
• Chef 360 Platform: Progress's SaaS or self-managed successor to Infra Server, Automate and Supermarket, covering node management, Courier job orchestration, skills and licensing (Chef).
• Chef Automate: Chef's dashboards, compliance reporting and workflow product, deprecated with a set end of life (Chef).
• Chef Infra: pull-based configuration management in which the node compiles Ruby recipes and converges them in order (Chef).
• Chef Infra Client: the Chef agent on every node, which compiles and converges the node's run-list (Chef).
• Chef Infra Server: the open-source server that stores cookbooks, node objects, roles, environments and policies and answers search, now deprecated (Chef).
• chef-solo: a way to run Chef Infra Client without Chef Infra Server, with cookbooks from a local directory or a tarball URL (Chef).
• chef-zero: a lightweight, in-process implementation of the Chef server API backed by the local repository, which local mode points the client at (Chef).
• ChefSpec: a unit testing framework for Chef cookbooks that runs a converge in memory and asserts what each resource would have done (Chef).
• Cinc: community rebuilds of Chef's open-source code (Client, Workstation, Auditor, Server) without Progress's EULA (Chef).
• Classification: the Puppet run step in which the server decides which classes a node gets, from node definitions or an External Node Classifier (Convergence: CFEngine to Puppet).
• Cloud Asset Inventory: Google Cloud's inventory of resource metadata, IAM and organization policies, with 35 days of history and export to BigQuery (Governance, Guardrails & the Resource Catalog).
• cloud-init: the boot-time agent most Linux cloud images carry, running in stages (Detect, Local, Network, Config, Final) to configure a generic image at first boot (Baking Images: Packer).
• CloudFormation: AWS's templating service of JSON or YAML templates with service-held stack state and change sets, AWS only and with no charge (Provisioning: Terraform, OpenTofu & the Alternatives).
• CloudQuery: a tool that syncs cloud and SaaS APIs into a SQL destination on a schedule, priced on rows synced (Governance, Guardrails & the Resource Catalog).
• CMDB (configuration management database): the IT service management record of configuration items and their relationships, filled from cloud APIs by discovery, the older form of a resource catalog (Governance, Guardrails & the Resource Catalog).
• Collection (Ansible): the distribution format for playbooks, roles, modules and plugins together (Push & Events: Ansible and Salt).
• Communicator: the mechanism Packer uses to upload files and run scripts on the machine being built, usually ssh or winrm (Baking Images: Packer).
• Compile phase: the first phase of a Chef run, in which recipe code runs and each resource it encounters is added to the ordered resource collection (Chef).
• Compile versus converge: desired state is compiled into a concrete resource list for one machine and then converged; where the compile happens (server, node or control node) is the biggest architectural difference between tools (Convergence: CFEngine to Puppet).
• Conditions (Event-driven Ansible): expressions in a rule evaluated against incoming events, such as event.payload.status == "OK" (Push & Events: Ansible and Salt).
• config_revision: the column recording which desired-state revision a convergence run applied: a Policyfile revision_id, a playbook or state-tree commit, or a hash where no id exists (Chef).
• Conformance pack: a collection of AWS Config rules and remediation actions deployed as one template to an account and region or across an organization (Governance, Guardrails & the Resource Catalog).
• Conftest: a wrapper around Open Policy Agent for testing configuration files against Rego policies, with rules named deny and conftest verify for testing the policies (Testing, Policy, Secrets & IaC Platforms).
• Container images (alternative to baking): building an OCI image and running it on a generic VM host, with fast builds and one artifact (Baking Images: Packer).
• Control (InSpec): a check that defines a regulatory recommendation or requirement for the state of a system, with an impact score (Chef).
• Control node: the machine from which the Ansible CLI tools run against managed nodes (Push & Events: Ansible and Salt).
• Convergence: repeated runs that move a machine toward its desired state and then hold it there, acting only on the difference (Convergence: CFEngine to Puppet).
• convergence_runs: the table with one row per convergence run per machine: a normalized status, counts, the revision applied and a pointer to the full report (Convergence: CFEngine to Puppet).
• Cookbook: Chef's unit of distribution: recipes, attribute files, templates, files, custom resources, libraries and metadata.rb with name, version and dependencies (Chef).
• Cookbook version constraints: limits on an environment that keep a new cookbook version moving through test environments before production (Chef).
• Corrective control: a guardrail that fixes a resource after the fact, such as Azure Policy remediation or AWS Config remediation, safe for a tag and dangerous for a security group a service depends on (Governance, Guardrails & the Resource Catalog).
• Courier: Chef 360's job orchestration, in which jobs are JSON documents split into steps per node and delivered by a pull model (Chef).
• Crossplane: a CNCF project that installs providers whose managed resources are Kubernetes custom resources for external objects, reconciled continuously instead of on each apply (Provisioning: Terraform, OpenTofu & the Alternatives).
• CSPM (cloud security posture management): detective controls and posture scores run over a cloud's inventory, such as Security Hub CSPM, Defender for Cloud and Security Command Center (Governance, Guardrails & the Resource Catalog).
• Custom resource (Chef): the recommended way to write a Chef resource since 12.5: one file with property declarations and action blocks, replacing the resource-plus-provider (LWRP) split (Chef).
• Data bags: Chef's global JSON data, each item a document with an id, read by recipes (Chef).
• Data source (Packer): a lookup at build time, such as the newest AMI matching a filter or a secret from a secrets manager (Baking Images: Packer).
• Dependency lock file: Terraform's .terraform.lock.hcl, which records for each provider the exact version selected, the constraints considered and its checksums (Provisioning: Terraform, OpenTofu & the Alternatives).
• Deprecate (image): hiding an image from other accounts' listings and the console while it stays launchable by id, the step before deregistering it (Baking Images: Packer).
• Deregister: removing an image for good; the owner pays for its snapshots until it does (Baking Images: Packer).
• Desired state: a description of what a machine should be (packages, files, services, users), not the steps to get there (Convergence: CFEngine to Puppet).
• Detective control: a guardrail that finds what already exists out of policy, only as good as the inventory under it (Governance, Guardrails & the Resource Catalog).
• Distribution configuration: the EC2 Image Builder setting for the regions, KMS keys, cross-account sharing and launch template updates an image goes to (Baking Images: Packer).
• Drift: a changed convergence run with no change to the desired state, meaning someone changed the machine and the tool undid it (Convergence: CFEngine to Puppet).
• Drift finding: a detected difference between code and what runs, opened with an owner and closed one of three ways: revert it, write it into code, or move the resource out of that state on purpose (Governance, Guardrails & the Resource Catalog).
• Driver (Test Kitchen): the platform Test Kitchen creates test machines on, such as Vagrant, EC2, Azure or Docker (Chef).
• Dry run: a run that reports what it would change and changes nothing: Puppet's noop, Chef's why-run, Ansible's check mode, Salt's test=True (Convergence: CFEngine to Puppet).
• EC2 Image Builder: AWS's managed pipeline producing AMIs and container images from image recipes, with infrastructure and distribution configurations (Baking Images: Packer).
• Environment (Chef): a workflow stage such as staging or production, with default and override attributes and cookbook version constraints (Chef).
• error-cleanup-provisioner: an optional Packer provisioner that runs only when normal provisioning fails, before the machine shuts down (Baking Images: Packer).
• Event-driven Ansible: Ansible's event reaction feature, whose unit is a rulebook of rulesets with sources, rules and actions (Push & Events: Ansible and Salt).
• Execution environment: a container image that acts as the Ansible control node, bundling ansible-core, ansible-runner, Python and dependencies (Push & Events: Ansible and Salt).
• Execution phase: the second phase of a Chef run, which walks the resource collection in order and changes only the difference from desired state (Chef).
• Exemption (Azure Policy): Azure's exception object, a waiver or mitigated category with requester, approver and ticket metadata and an optional expiry, kept for the record after it expires (Governance, Guardrails & the Resource Catalog).
• Expected lag (inventory): how stale an inventory source may be and still be trusted; a resource unseen for longer is unconfirmed, not present (Governance, Guardrails & the Resource Catalog).
• Exported resources: Puppet's cross-node configuration, in which a node publishes a resource with @@ for other nodes to collect through PuppetDB (Convergence: CFEngine to Puppet).
• External Node Classifier (ENC): a program that takes a host name and returns the Puppet classes and parameters the node gets (Convergence: CFEngine to Puppet).
• external_ref: the provider's identifier for an object, unique per kind and never reused, so an import, a refresh and an abuse report all resolve to one resource (Provisioning: Terraform, OpenTofu & the Alternatives).
• Extra vars: Ansible variables passed with -e, which always win precedence (Push & Events: Ansible and Salt).
• Fact gathering: the agent inventorying a machine (OS, kernel, addresses, hardware, custom values) before deciding anything; facts select which desired state applies (Convergence: CFEngine to Puppet).
• Failed: the run status for a convergence run that couldn't repair something (Convergence: CFEngine to Puppet).
• Fingerprint (Packer): the identifier each packer build run gets in HCP Packer; a build fails when its fingerprint matches an existing, complete version (Baking Images: Packer).
• Free strategy: the Ansible strategy that lets each host run to the end of a play as fast as it can (Push & Events: Ansible and Salt).
• Fried image: a generic image configured at boot, or continuously, by configuration management (Baking Images: Packer).
• Golden image: the approved, built and tested image everything launches from (Baking Images: Packer).
• Google Cloud VM Manager OS policies: OS policy assignments that target VMs by labels, OS and zone, enforced by the OS Config agent (Convergence: CFEngine to Puppet).
• Grains: facts about a Salt minion (OS, domain, IP address, kernel, custom values), set by the minion and therefore a claim, not proof (Push & Events: Ansible and Salt).
• Graph (Terraform): the dependency graph built from configuration and state together, with a node per resource and provider configuration and edges from references and depends_on (Provisioning: Terraform, OpenTofu & the Alternatives).
• Guard: a Chef condition on a resource whose effect isn't knowable, not_if to skip when true and only_if to run only when true (Chef).
• Guardrail: one rule written in plain words, enforced or checked by some engine at one or more layers: organization, plan time, admission and runtime (Governance, Guardrails & the Resource Catalog).
• Guardrail exception: a waiver or mitigation recorded with a category, a reason, an approver who isn't the requester and an end date; an expired one reopens its findings (Governance, Guardrails & the Resource Catalog).
• Habitat: Chef's application packaging plus a runtime supervisor, which packaged the application rather than converging the host (Chef).
• Handlers (Ansible): tasks that run only when a task reporting "changed" notifies them, once regardless of how many tasks notify them (Push & Events: Ansible and Salt).
• Hard mandatory: Sentinel's strictest enforcement level, with no override; the only bypass is removing the policy (Testing, Policy, Secrets & IaC Platforms).
• HCP Packer: HashiCorp's registry of image metadata (not images): buckets of versions, channels as named pointers, ancestry and revocation (Baking Images: Packer).
• HCP Terraform: HashiCorp's hosted Terraform platform for state, runs, policy and registry, self-managed as Terraform Enterprise, billed hourly per managed resource (Testing, Policy, Secrets & IaC Platforms).
• HCSEC-2021-12: the HashiCorp advisory after the Codecov compromise exposed the GPG key that signs its download checksums, which argued for keeping signing keys out of CI that runs third-party code (Testing, Policy, Secrets & IaC Platforms).
• HCSEC-2026-23: the HashiCorp advisory for flaws in terraform-mcp-server, the server that lets AI assistants drive Terraform, which could expose or reuse users' Terraform tokens (Testing, Policy, Secrets & IaC Platforms).
• Health assessments: HCP Terraform's scheduled drift detection and continuous validation of conditions and check blocks, which never change infrastructure (Governance, Guardrails & the Resource Catalog).
• Hiera: Puppet's key-value configuration data, looked up during compilation through a defaults-with-overrides hierarchy (Convergence: CFEngine to Puppet).
• Highstate: everything a Salt top file assigns to a minion, applied by running state.apply with no SLS targets (Push & Events: Ansible and Salt).
• Idempotence: the property that applying the same desired state twice changes nothing the second time, which each resource implementation must have (Convergence: CFEngine to Puppet).
• Idempotent create: the provider API requirement that a retried apply after a timeout doesn't produce a twin, met by a client-supplied idempotency key or an enforced unique name (Provisioning: Terraform, OpenTofu & the Alternatives).
• Image families: Google Cloud's pointer to the most recent image in a family; deprecating the newest image rolls the family back to the previous one (Baking Images: Packer).
• Image recipe: an EC2 Image Builder definition of a base image plus components, YAML or JSON documents run in build, validate and test phases (Baking Images: Packer).
• Immutable server: a server that, once deployed, is never modified, only replaced (Baking Images: Packer).
• Import (Terraform): adopting an existing object into state with an import block naming the address and the vendor's identifier or provider-defined identity (Provisioning: Terraform, OpenTofu & the Alternatives).
• Infracost: a tool that parses Terraform, CloudFormation and CDK projects or a plan and posts the monthly cost difference on each pull request (Testing, Policy, Secrets & IaC Platforms).
• Infrastructure configuration: the EC2 Image Builder setting for the instance type, subnet and IAM role a build runs with (Baking Images: Packer).
• InSpec: compliance checks as code, organized as profiles of controls, run separately from the tool that converged the machine (Chef).
• Integration tests (IaC): applying a module to a real account and checking the result from outside, which catches provider bugs, API defaults and missing permissions that mocks can't (Testing, Policy, Secrets & IaC Platforms).
• Inventory (Ansible): the list of managed nodes from one or more sources, with groups for targeting and assigning variables (Push & Events: Ansible and Salt).
• Kept / repaired: CFEngine's outcomes for an evaluated promise (already true, or fixed), after which it is locked for a period so repeated runs don't re-evaluate it (Convergence: CFEngine to Puppet).
• Landing zone: the multi-account structure plus the process that decides where new accounts go and what they inherit (Governance, Guardrails & the Resource Catalog).
• Landing Zone Accelerator: AWS's pipeline, installed from a CloudFormation template, that deploys a regulated estate's baseline from configuration files (Governance, Guardrails & the Resource Catalog).
• Lineage and serial: a Terraform state's fixed identifier and its write counter, which act as optimistic concurrency control: a different lineage is a different state, a lower serial a stale copy (Provisioning: Terraform, OpenTofu & the Alternatives).
• Linear strategy: Ansible's default strategy, which runs each task on all hosts in a play before starting the next task (Push & Events: Ansible and Salt).
• Local mode: running Chef Infra Client with -z against an in-process chef-zero server backed by the local repository (Chef).
• Managed nodes: the servers and devices an Ansible control node targets, which normally don't have Ansible installed (Push & Events: Ansible and Salt).
• Managed resource: HCP Terraform's billing unit: a resource with mode = "managed" in HCP-managed state, counted from its first plan or apply and billed hourly (Testing, Policy, Secrets & IaC Platforms).
• Management group: Azure's scope above subscriptions, up to six levels deep, where policy assignments attach and are inherited (Governance, Guardrails & the Resource Catalog).
• Mandatory (run task): the run task enforcement level whose failure blocks the run, against advisory; the most restrictive wins when several apply (Testing, Policy, Secrets & IaC Platforms).
• Master (Salt): the machine running salt-master that orchestrates minions over the event bus (Push & Events: Ansible and Salt).
• Masterfiles Policy Framework (MPF): the default policy CFEngine ships, which schedules an agent run every five minutes with a splay (Convergence: CFEngine to Puppet).
• Minion: any system or device managed by Salt, usually running salt-minion (Push & Events: Ansible and Salt).
• Module (Ansible): the code or binaries Ansible copies to and executes on each managed node for a task (Push & Events: Ansible and Salt).
• Moved (Terraform): a moved block that rewrites a resource's state address before planning, so a rename doesn't destroy and recreate the object (Provisioning: Terraform, OpenTofu & the Alternatives).
• No-code module: a private-registry module version marked No-code Ready, from which a user creates a workspace and starts its first run without writing Terraform (Governance, Guardrails & the Resource Catalog).
• Node object: the Chef server's record of a node: its run-list, environment, normal attributes and last Ohai data (Chef).
• Noop: Puppet's mode that partially simulates a run, reporting what each resource would change without touching anything (Convergence: CFEngine to Puppet).
• Ohai: Chef's system profiler, which supplies node data such as platform, kernel, network, memory and cloud metadata at the start of a run (Chef).
• Open Policy Agent (OPA): a CNCF policy engine that evaluates Rego policies against JSON input, such as a Terraform plan (Testing, Policy, Secrets & IaC Platforms).
• OpenBao: the community fork of the last MPL-licensed Vault: a secrets manager with encrypted key-value storage, dynamic secrets, encryption as a service, leases and revocation (Testing, Policy, Secrets & IaC Platforms).
• OpenTofu: the MPL-2.0 fork of Terraform under the CNCF, with the same backends and client-side state encryption (Provisioning: Terraform, OpenTofu & the Alternatives).
• OpenVox: a community soft fork of Puppet by Vox Pupuli, with the same model under Apache 2.0 (Convergence: CFEngine to Puppet).
• Organization Policy (Google Cloud): constraints on what configurations are allowed, managed or custom in CEL, in active or dry-run mode, inherited down the hierarchy and not retroactive (Governance, Guardrails & the Resource Catalog).
• Owner (team reference): ownership recorded as a reference to a team that exists, assigned at vending and inherited down, with owner tags generated from it rather than typed (Governance, Guardrails & the Resource Catalog).
• Packer: HashiCorp's tool for building machine images from a template across platforms, whose core is under the BSL and whose plugins are MPL (Baking Images: Packer).
• Partner provider: a Terraform provider written and maintained by the company whose API it wraps, in the partner's own registry namespace (Provisioning: Terraform, OpenTofu & the Alternatives).
• Pillar: Salt data compiled on the master and mapped to minions by a top file, readable only by the minion it is targeted to (Push & Events: Ansible and Salt).
• Plan (Terraform): the graph walk with every provider asked what it would do, listing each resource change with its address and actions for review before apply (Provisioning: Terraform, OpenTofu & the Alternatives).
• Platform and workload landing zones: Azure's split: one platform landing zone per Entra tenant for governance, security and shared networking, and one workload landing zone per workload (Governance, Guardrails & the Resource Catalog).
• Platforms (Test Kitchen): the operating systems a Test Kitchen suite is tested on (Chef).
• Playbook: an Ansible YAML file of plays, each mapping a set of hosts to an ordered list of tasks (Push & Events: Ansible and Salt).
• Plays: the units of an Ansible playbook, each mapping a set of hosts to an ordered list of tasks (Push & Events: Ansible and Salt).
• Policy group: a set of Chef nodes that share the same run-list and cookbooks, to which a Policyfile lock is pushed (Chef).
• Policy set: a collection of policies HCP Terraform checks against every run's plan, scoped to the organization, projects, workspaces, Stacks or tagged workspaces (Governance, Guardrails & the Resource Catalog).
• Policyfile.lock.json: the Policyfile lock recording every cookbook's version, content identifier and source, the attributes, and the policy's revision_id (Chef).
• Policyfiles: Chef's answer to roles, environments and Berkshelf: a policy resolved into a lock and promoted unchanged from policy group to policy group (Chef).
• Post-processor: a Packer step that runs on the result after the build and provisioners: compress, checksum, import or record it (Baking Images: Packer).
• Precedence (Chef attributes): how Chef resolves a key set by several sources: six types and fifteen levels applied from lowest to highest, with the last one winning (Chef).
• Preventive control: a guardrail that refuses the action at request time, such as an SCP or RCP, and needs nothing stored (Governance, Guardrails & the Resource Catalog).
• Proactive control: a guardrail that checks a resource before it is provisioned and refuses it, such as a CloudFormation hook (Governance, Guardrails & the Resource Catalog).
• Profile (InSpec): a reusable, versioned artifact that organizes multiple InSpec controls, with dependencies (Chef).
• Progress: the company that acquired Chef Software and now owns Chef's products (Chef).
• Promise: CFEngine's basic statement, made by a promiser (the object it affects) optionally to promisees (the stakeholders) (Convergence: CFEngine to Puppet).
• Promisees: the stakeholders a CFEngine promise is made to (Convergence: CFEngine to Puppet).
• Promiser: the object a CFEngine promise affects, such as a file or a port (Convergence: CFEngine to Puppet).
• Provisioner (Packer): software that installs and configures the running machine before Packer captures it as an image (Baking Images: Packer).
• Provisioner (Test Kitchen): the component that applies configuration to a Test Kitchen machine, such as the Chef provisioner resolving cookbooks with Policyfiles or Berkshelf (Chef).
• Proxy minion: a Salt minion process that manages a device unable to run a minion itself (Push & Events: Ansible and Salt).
• Pull agent and run interval: a daemon on each machine that fetches its desired state and applies it on a timer, so drift is corrected automatically every interval (Convergence: CFEngine to Puppet).
• Pulumi: infrastructure as code in general-purpose languages, with state in Pulumi Cloud by default or in a customer-chosen backend, and secrets in state encrypted per stack (Provisioning: Terraform, OpenTofu & the Alternatives).
• Pulumi Cloud: Pulumi's hosted state, deployments and secrets (ESC), billed in credits drawn by resource-hours (Testing, Policy, Secrets & IaC Platforms).
• Puppet: pull-based configuration management in which the agent sends facts, the server compiles a catalog and the agent applies it on an interval (Convergence: CFEngine to Puppet).
• Puppet Forge: the public site where Puppet modules are shared and installed from (Convergence: CFEngine to Puppet).
• PuppetDB: the store of the latest facts, catalog and optionally reports for every Puppet node, which also enables exported resources (Convergence: CFEngine to Puppet).
• Puppetfile: the file that pins Puppet modules for sites deploying code with r10k or Code Manager (Convergence: CFEngine to Puppet).
• Reactor: the Salt master component that maps event tags to reactor SLS files, so an event can trigger a function on minions or the master (Push & Events: Ansible and Salt).
• Refresh (Puppet): a resource reacting when a resource it subscribes to or is notify'd by changes, the classic case being a service restarting when its config file changes (Convergence: CFEngine to Puppet).
• Refresh (Terraform): a plan asking each provider to read the real object and compare it with the cached attributes in state (Provisioning: Terraform, OpenTofu & the Alternatives).
• Remediation task: Azure Policy's job that applies modify or deployIfNotExists to existing resources, running as the assignment's managed identity (Governance, Guardrails & the Resource Catalog).
• Removed (Terraform): a removed block that drops an object from state while leaving it running, the declarative way to stop managing something (Provisioning: Terraform, OpenTofu & the Alternatives).
• Report (convergence): what a run did per resource (previous and new values, success or failure, timing), the evidence of convergence (Convergence: CFEngine to Puppet).
• Required tags: AWS tag policy keys marked mandatory for resource creation (report_required_tag_for, November 20, 2025), enforced in CloudFormation by a managed hook in warn or fail mode (Governance, Guardrails & the Resource Catalog).
• Resource Abstraction Layer (RAL): Puppet's split of each resource into a type that names it and its properties, and providers that implement it for one platform (Convergence: CFEngine to Puppet).
• Resource address: the key of each object in Terraform state (module path, mode, type, name and index), which moved blocks rewrite (Provisioning: Terraform, OpenTofu & the Alternatives).
• Resource catalog: the list of what exists, who owns it and how fresh that knowledge is, joined from IaC state, the cloud inventory and the software catalog; its most useful output is where they disagree (Governance, Guardrails & the Resource Catalog).
• Resource control policy (RCP): an AWS Organizations policy, since November 13, 2024, that sets the maximum permissions on resources even for principals outside the organization and grants nothing (Governance, Guardrails & the Resource Catalog).
• Resource Explorer: AWS's organization-wide search for resources by name, tag and ID, eventually consistent and free (Governance, Guardrails & the Resource Catalog).
• Restricted channel: an HCP Packer channel hidden from viewers, so a version can be tested in a channel such as candidate before promotion (Baking Images: Packer).
• Revision ID (revision_id): the identifier of a Chef Policyfile lock, so a node's configuration is an artifact with an id that can be promoted and rolled back (Chef).
• Revocation (images): marking an image version unusable, immediately or on a schedule, so no new builds or launches use it, cascading to descendants (Baking Images: Packer).
• Role (Ansible): a limited distribution of reusable Ansible content (tasks, handlers, variables, templates, files) imported into a play (Push & Events: Ansible and Salt).
• Role (Chef): a job function, with a run-list plus default and override attributes; a node can have several (Chef).
• Roster: the Salt SSH file listing target machines, /etc/salt/roster by default (Push & Events: Ansible and Salt).
• Rulebook: the unit of Event-driven Ansible, a set of rulesets each with event sources and rules (Push & Events: Ansible and Salt).
• Rules (Event-driven Ansible): the parts of a ruleset whose conditions are evaluated against incoming events and which run an action on a match (Push & Events: Ansible and Salt).
• Rulesets: groups within an Event-driven Ansible rulebook, each with one or more event sources and rules (Push & Events: Ansible and Salt).
• Run tasks: HCP Terraform's integration point that calls an external service at pre-plan, post-plan, pre-apply or post-apply and takes its pass or fail (Testing, Policy, Secrets & IaC Platforms).
• Run-list: the ordered list of recipes, named cookbook::recipe, that a Chef node converges (Chef).
• Salt: configuration management with a master and minions on an event bus, and agentless operation over SSH (Push & Events: Ansible and Salt).
• Salt SSH: running Salt commands and states over SSH without installing a minion, by copying a thin Salt tarball to the target; substantially slower than minions (Push & Events: Ansible and Salt).
• SCARLETEEL: an attack in which credentials taken from a cluster node's metadata service read a terraform.tfstate holding a clear-text access key for a second account, the case for keeping state locked down and secret-free (Testing, Policy, Secrets & IaC Platforms).
• Scripts against a panel API: imperative calls to a hosting panel's API (such as cPanel's WHM API), with no plan, no state, no graph and invisible drift (Provisioning: Terraform, OpenTofu & the Alternatives).
• Sentinel: HashiCorp's policy language in HCP Terraform and Terraform Enterprise, with advisory, soft mandatory and hard mandatory enforcement levels (Testing, Policy, Secrets & IaC Platforms).
• Service catalog: a list of what may be created, such as AWS Service Catalog portfolios of CloudFormation or Terraform products, or HCP Terraform no-code modules (Governance, Guardrails & the Resource Catalog).
• Service control policy (SCP): an AWS Organizations policy that limits what principals in member accounts can do, with a deny at any level of the tree winning (Governance, Guardrails & the Resource Catalog).
• Skills (Chef 360): agents that act on a node in Chef 360, some packaged as Habitat packages (Chef).
• Soft mandatory: a Sentinel enforcement level that must pass unless an authorized operator overrides it, which records who overrode a failed policy (Testing, Policy, Secrets & IaC Platforms).
• Software catalog: a list of what runs and who owns it, with relations such as ownedBy and dependsOn connecting services to their resources and teams (Governance, Guardrails & the Resource Catalog).
• SOPS: a tool that encrypts values inside YAML, JSON, ENV, INI and binary files with a KMS, age or PGP, so an encrypted file can live in the repository (Testing, Policy, Secrets & IaC Platforms).
• Spacelift: a hosted orchestration platform for OpenTofu, Terraform, Terragrunt, Pulumi and Kubernetes, with private workers in the customer's own cloud (Testing, Policy, Secrets & IaC Platforms).
• Splay: a per-host delay added to a pull agent's run so a fleet doesn't hit the server in the same second (Convergence: CFEngine to Puppet).
• Stacks: an HCP Terraform layer above workspaces that declares several components and their deployments across environments or regions in one configuration (Provisioning: Terraform, OpenTofu & the Alternatives).
• State encryption: OpenTofu's client-side encryption of state and plan files before they reach any backend, its clearest divergence from Terraform (Provisioning: Terraform, OpenTofu & the Alternatives).
• States (Salt): Salt's desired state, written in SLS files (YAML with Jinja) with requisites such as require and watch (Push & Events: Ansible and Salt).
• Static checks: credential-free checks against configuration (validate, formatting, policy scanners) that cost nothing to run (Testing, Policy, Secrets & IaC Platforms).
• Steampipe: an AGPL-3.0 CLI that exposes 150+ APIs as Postgres foreign tables queried live, with Powerpipe adding open controls (Governance, Guardrails & the Resource Catalog).
• Suites (Test Kitchen): run-lists with attributes that Test Kitchen converges and verifies on each platform (Chef).
• Supermarket: Chef's cookbook registry, public or run privately by a company (Chef).
• Supervisor (Habitat): Habitat's runtime with deployment coordination and service discovery built in, under which Habitat packages run (Chef).
• Tag policy: an AWS Organizations policy that standardizes tag keys, case and allowed values; untagged resources aren't evaluated by it (Governance, Guardrails & the Resource Catalog).
• Tag (Salt event): the string each event on the Salt event bus carries for filtering, alongside a dictionary of data (Push & Events: Ansible and Salt).
• Tags versus labels (Google Cloud): labels are per-resource metadata usable to filter billing; tags are separate, inherited resources usable in IAM and Organization Policy conditions (Governance, Guardrails & the Resource Catalog).
• Tasks (Ansible): the ordered steps of a play, each calling a module (Push & Events: Ansible and Salt).
• Template (Packer): a Packer configuration, in HCL2 or legacy JSON (Baking Images: Packer).
• Terraform: HashiCorp's provisioning tool: HCL configuration, providers over gRPC, customer-held state, and plan then apply, with the largest provider and module ecosystem (Provisioning: Terraform, OpenTofu & the Alternatives).
• Terraform policy (tfpolicy): HashiCorp's HCL policy framework, generally available July 16, 2026, that checks actual infrastructure state as well as planned changes (Governance, Guardrails & the Resource Catalog).
• Test Kitchen: a test harness that runs infrastructure code on one or more platforms in isolation, configured by a driver, provisioner, platforms, verifier and suites (Chef).
• tfsec: a Terraform security scanner now folded into Trivy, which carries the same scanning engine (Testing, Policy, Secrets & IaC Platforms).
• Top file: Salt's top.sls, which maps groups of machines to the states they get, per environment (Push & Events: Ansible and Salt).
• The transaction (Puppet): the agent converting a catalog into a dependency graph, sorting it and converging each resource; it isn't atomic, so a failure halfway leaves earlier changes (Convergence: CFEngine to Puppet).
• Trivy: Aqua's scanner, which absorbed tfsec's Terraform scanning engine (Testing, Policy, Secrets & IaC Platforms).
• Type (Puppet): the part of a Puppet resource that names it and its properties, implemented per platform by providers (Convergence: CFEngine to Puppet).
• Unchanged: the run status for a convergence run that found every resource already correct (Convergence: CFEngine to Puppet).
• Unified Mode: a Chef custom-resource mode that compiles and converges each action block in one pass, so resources run in the order written; the default from Chef Infra Client 18 (Chef).
• Unit tests (IaC): tests against a plan or mocked providers that prove a module's logic without creating anything (Testing, Policy, Secrets & IaC Platforms).
• Values in the state file: whatever a provider returns is stored in Terraform state and plan files in plain text, and sensitive only redacts it from output, so state must be treated as secret (Testing, Policy, Secrets & IaC Platforms).
• Vault: HashiCorp's secrets manager, moved to the BSL with the rest of HashiCorp's products, each release converting to MPL 2.0 after four years (Testing, Policy, Secrets & IaC Platforms).
• Verifier (Test Kitchen): the tool that checks a converged Test Kitchen machine, such as InSpec, Cinc Auditor or Serverspec (Chef).
• Waiver versus mitigated: the two exception categories: non-compliance temporarily accepted, or the rule's intent met another way through a compensating control (Governance, Guardrails & the Resource Catalog).
• Well-Architected review: a check of a workload against a provider's architecture framework, a conversation about decisions rather than an audit, and not a guardrail (Governance, Guardrails & the Resource Catalog).
• Why-run mode: Chef's dry run, which runs Chef on a system without the providers modifying it (Chef).
• Workspaces (Terraform CLI): several named states for one configuration in one backend, which the docs say are not appropriate for system decomposition (Provisioning: Terraform, OpenTofu & the Alternatives).

Web Hosting#

• aaPanel: a server panel with a free Core edition and a paid Pro edition (Control Panel Licensing & the Alternatives).
• Absorb, pass through or replace: the three ways a host handles panel license cost: absorb it in shared plan prices, pass it through as an invoice line on VPS and dedicated, or replace the panel (Control Panel Licensing & the Alternatives).
• Ancestor DCV: AutoSSL's rule that a successful domain-control check on example.com also covers its subdomains, such as store.example.com (cPanel & WHM).
• Apache SpamAssassin: the spam scorer in panel mail, where the customer sets a threshold for marking and an optional threshold for deletion (Email Hosting).
• Automattic's hosted WordPress: WordPress.com plans, Pressable and WP Cloud, run by the WordPress project's main steward (Managed WordPress).
• AutoSSL: cPanel & WHM's built-in certificate automation, which issues and renews a DV certificate for every domain on every account without the customer asking, with Let's Encrypt as the default provider (cPanel & WHM).
• Backup (cPanel): the customer-side interface offering a full backup for download and partial backups (home directory, databases, forwarders, filters) the customer can restore; a full backup can't be restored automatically from cPanel (Backups, Restores & Migrations).
• Backup Configuration: the root-level WHM service, set once per server, that defines backup type, schedule, retention, database handling and destinations (Backups, Restores & Migrations).
• Backup User Selection: the WHM setting that excludes accounts from scheduled backups; accounts are included by default (Backups, Restores & Migrations).
• Backup Wizard: the cPanel tool that sends a full backup to the home directory or a remote FTP or SCP server (Backups, Restores & Migrations).
• Bati Courtage: an OVH ruling in which backups described as physically isolated from the VPS were stored in the same building as the server (Backups, Restores & Migrations).
• Block-level snapshots: snapshots of a server or volume by the hypervisor or storage layer: fast, crash-consistent and whole-machine rather than per account (Backups, Restores & Migrations).
• Bluepad: an OVH ruling in which production ran in one datacenter building and backups in another, although the customer had been told both were in the same one (Backups, Restores & Migrations).
• Bookings (hosting): the value of terms sold in a period, which leads revenue because long prepaid terms are recognized over time (How Web Hosting Makes Money).
• Bot classification: excluding suspected bots from a visit count, which makes the classifier's errors billing errors and is why its version is recorded per day (Managed WordPress).
• BoxTrapper: cPanel's challenge-response spam option, which sends a verification email to unknown senders (Email Hosting).
• Browser cache: assets kept on the visitor's device, the outermost cache layer of a WordPress site (Managed WordPress).
• Bundle (hosting): the free items attached to a hosting plan (domain, privacy, certificate, mailboxes, backups, CDN), each with its own renewal clock and its own standalone price (How Web Hosting Makes Money).
• CAA preflight: AutoSSL adding a CAA record to a domain's zone before ordering a certificate, so the chosen CA is allowed to issue (cPanel & WHM).
• Cloud Solution Provider (CSP): Microsoft's program for reselling Microsoft 365, through distributors (indirect) or by billing customers directly (direct-bill) (Email Hosting).
• CloudPanel: a free but proprietary server panel for NGINX, PHP, Node.js and Python sites, "licensed and not sold," whose terms restrict resale (Control Panel Licensing & the Alternatives).
• cPanel & WHM: WebPros' hosting control panel, licensed per server and priced by account count, with root, resellers, packages, feature lists and accounts (cPanel & WHM).
• cPanel account: one Unix user with a primary domain, its addon, parked and sub domains, databases, mailboxes and FTP users, created from a package (cPanel & WHM).
• Custom copy: a WP Engine environment copy that moves files, all tables or selected tables, from the current state or a backup point (Managed WordPress).
• Customer-held offsite copies: exports to the customer's own bucket or a plugin's storage, which survive the host's failure or the end of the relationship (Backups, Restores & Migrations).
• CyberPanel: a free GPL-3.0 server panel built around OpenLiteSpeed, with paid add-ons (Control Panel Licensing & the Alternatives).
• DirectAdmin: a hosting panel licensed per server and priced by account count, with admin, reseller and user levels (cPanel & WHM).
• DKIM: a TXT record at selector._domainkey holding the public key that verifies a domain's mail signatures; the host generates a key per domain, signs outbound mail and rotates (Email Hosting).
• DMARC: a TXT record at _dmarc stating the domain's policy when SPF and DKIM don't align and where to send reports (Email Hosting).
• Dovecot: the IMAP and POP3 server in panel mail, serving mailboxes in mdbox format (Email Hosting).
• EasyApache 4: cPanel's tool that installs, configures, updates and validates Apache and PHP as system packages, with preconfigured profiles (cPanel & WHM).
• Edge full-page cache: an optional cache of HTML at the CDN, following Cache-Control and bypassed on the same paths as the page cache (Managed WordPress).
• Email Deliverability: the cPanel page that checks a domain's DKIM, SPF and PTR records (Email Hosting).
• Email Routing: the cPanel setting that decides whether the server accepts mail for a domain: Local, Backup (hold until a lower-numbered MX is available) or Remote (Email Hosting).
• Environments (WordPress): at least a production and a staging copy of each site, often a development one too (Managed WordPress).
• Exim: the mail transfer agent cPanel & WHM includes, configured in WHM for spam rejection, DKIM verification and sender checks (Email Hosting).
• Feature list: a cPanel list of which tools an account using a package can see; it controls tools, not limits (cPanel & WHM).
• Full copy: a WP Engine environment copy that moves all files and all tables (Managed WordPress).
• General migration plugin: a plugin such as All-in-One WP Migration or Duplicator that moves one WordPress site from any host to any host (Backups, Restores & Migrations).
• Google Workspace resale: reselling Workspace as an authorized reseller with a signed reseller contract, through the Partner Sales Console and the Reseller API (Email Hosting).
• HestiaCP: a free, community GPL-3.0 hosting panel based on VestaCP that installs a web, mail, DNS and database stack (Control Panel Licensing & the Alternatives).
• Intro price: a hosting plan's headline price, which is a discount for prepaying a long term; the plan renews at a higher list price for the same term (How Web Hosting Makes Money).
• Isolation tiers: shared versus isolated managed WordPress plans, where isolation and stronger SLAs come with the higher tiers (Managed WordPress).
• ISPConfig: a free BSD-licensed panel that manages multiple servers from one panel, with paid modules (Control Panel Licensing & the Alternatives).
• Live Transfer: cPanel-to-cPanel migration that also updates A, nameserver and MX records so the cutover happens with the copy (Backups, Restores & Migrations).
• Managed WordPress: a WordPress-only platform with a tuned stack, environments, backups, managed updates and caching, usually priced by visits (Managed WordPress).
• Microsoft 365 (Exchange Online): Microsoft's mail service, which caps recipients per day and messages per minute per mailbox (Email Hosting).
• MultiPHP: cPanel's feature that lets several PHP versions coexist, setting a server default and each virtual host's version (cPanel & WHM).
• MX: the DNS record naming which servers receive mail for a domain, lowest preference first (Email Hosting).
• New Commerce Experience (NCE): Microsoft's purchasing model for license-based subscriptions, with monthly, annual or three-year terms that can be canceled only in a short window after purchase (Email Hosting).
• Newfold Digital: the hosting group behind Bluehost, HostGator, Network Solutions and other brands (How Web Hosting Makes Money).
• Object cache: a cache of database query results and computed values for WordPress, often optional or an upsell (Managed WordPress).
• Open-source hosting panels: panels free per server with paid add-ons or support (Virtualmin, HestiaCP, CyberPanel and others), with no license fee (Control Panel Licensing & the Alternatives).
• Package (cPanel): a named set of resource options and settings plus one feature list, owned by root or a reseller and applied to accounts (cPanel & WHM).
• Page cache: the cache (Varnish at WP Engine) of a page's generated HTML, bypassed for admin, login, cart and checkout pages and logged-in cookies (Managed WordPress).
• Panel transfer: migrating whole accounts, including mail, with WHM's Transfer Tool or Live Transfer, which needs root on both ends (Backups, Restores & Migrations).
• Panel-native backups: per-account archives on a schedule (WHM, Plesk) to local and remote destinations, restorable per account (Backups, Restores & Migrations).
• Pantheon: a container platform for WordPress with Dev, Test and Live environments, metered by site visits and pages served (Managed WordPress).
• Partner (NOC) agreement: how hosts buy cPanel licenses at prices below the store's and resell them to VPS and dedicated customers (Control Panel Licensing & the Alternatives).
• PHP handler: the panel setting that decides which user a PHP request runs as (CGI, DSO, suPHP, PHP-FPM, FCGId, LSAPI), and so whether one account can read another's files (cPanel & WHM).
• Platform checkpoints: managed WordPress's daily site copies in the platform's own storage, restorable from the dashboard (Backups, Restores & Migrations).
• Plesk: WebPros' hosting panel, licensed per server in editions by domain count, organized as subscriptions and service plans per customer (cPanel & WHM).
• Pressable: Automattic's managed WordPress, built on WP Cloud and metered by visits and storage (Managed WordPress).
• Pro email: a paid mailbox product with its own intro and renewal prices, bigger mailboxes and the mail moved off the web server, often white-labeled from one vendor (Email Hosting).
• PTR: the reverse DNS name of a sending IP, which should match the server's forward name and belongs to the host, not the customer (Email Hosting).
• Replication instead of backup: live copies in a second location, with low recovery time but deletions and corruption replicated too (Backups, Restores & Migrations).
• Reseller (cPanel): a cPanel account with WHM access, created by root and given a privilege list and account limits to sell hosting under (cPanel & WHM).
• Reseller API: Google's API for Workspace resellers, covering resellers, customers, payment plans, product SKUs and licenses (Email Hosting).
• Reseller privilege groups: cPanel's grouping of reseller ACLs into Basic, Package, Global, Super and Root Access, from managing one's own accounts to complete access to the server (cPanel & WHM).
• Resource options: the numeric limits a cPanel package sets, such as disk quota, bandwidth, mail and FTP accounts, databases and hourly outbound mail (cPanel & WHM).
• Retention rises with tenure: a hosting customer who survives the first renewal is more likely to survive the next, so the business is designed around the first renewal (How Web Hosting Makes Money).
• Rocket.net: a managed WordPress host that leaves visitors unmetered and bills storage and bandwidth (Managed WordPress).
• Root (cPanel): the server owner in cPanel & WHM, holding every account, service and setting, global packages and the limits every reseller lives under (cPanel & WHM).
• Roundcube: the webmail in panel mail, which replaced Horde and SquirrelMail in cPanel (Email Hosting).
• Settings (cPanel package): the switches a package sets, such as dedicated IP, shell access, CGI, theme and locale (cPanel & WHM).
• SPF: a TXT record listing which servers may send as a domain, with a limit on DNS-querying terms that the host should warn about (Email Hosting).
• Standalone price: the regular price each bundled item still has, used to allocate revenue and to deduct from refunds (How Web Hosting Makes Money).
• Standardized Hooks: cPanel's mechanism to run the host's code when the panel does something, registered per hookable event with manage_hooks (cPanel & WHM).
• Suspension (cPanel): the panel's enforcement verb, redirecting web traffic, invalidating the password and acting on incoming mail, optionally locked so resellers can't lift it (cPanel & WHM).
• Transfer Tool: WHM's tool that copies cPanel accounts, packages and configurations from a source server to a destination server (Backups, Restores & Migrations).
• Tweak Settings: WHM's server-wide settings, including the maximum hourly emails per domain and the failed or deferred percentage before outbound mail is blocked (Email Hosting).
• UAPI: cPanel's API for operations inside one cPanel account, callable from the shell or over HTTPS (cPanel & WHM).
• Unique IP per day: a visit-counting rule that undercounts behind carrier-grade NAT and overcounts with IPv6 privacy addresses (Managed WordPress).
• Usage-metered plans: hosting with an allowance and overage by visits, bandwidth or compute, so revenue tracks usage (How Web Hosting Makes Money).
• Virtualmin: a panel with a free GPL edition and a Professional edition licensed by domains (Control Panel Licensing & the Alternatives).
• Visits: the managed WordPress pricing unit, a count of visitors the customer understands and the host can map to PHP work, which has to be publicly defined and explainable (Managed WordPress).
• Webmin: a BSD-licensed web-based system administration tool for Unix-like servers, which administers a server rather than selling hosting accounts (Control Panel Licensing & the Alternatives).
• White-labeled pro email: a mail platform vendor's mailboxes sold under the host's brand, as Titan powers Bluehost's and GoDaddy's (Email Hosting).
• WHM API 1: cPanel's API for server and reseller operations, such as listaccts, createacct and suspendacct, authenticated with an API token (cPanel & WHM).
• Wholesale and reseller: hosting sold to resellers who set their own retail price (How Web Hosting Makes Money).
• WordPress.com: Automattic's hosted WordPress, which doesn't meter visits and allows plugins from the Personal plan (Managed WordPress).
• WP Engine v. Automattic: the dispute in which Automattic cut WP Engine off from WordPress.org and WP Engine sued, showing that a host's update channel, directory and trademark use are supplier dependencies (Managed WordPress).
• WP Squared: cPanel's WordPress-focused panel, licensed by WordPress site (Control Panel Licensing & the Alternatives).
• WP-CLI: the command line for WordPress, which hosts use to run backups, search-replace for pushes and migrations, cache flushes and updates at scale (Managed WordPress).
• WP-Cron: WordPress's scheduler, which runs due tasks only on page load and so doesn't run on a site behind a page cache unless system cron triggers it (Managed WordPress).

Domains and DNS#

• .ai (Anguilla): Anguilla's ccTLD, whose registration sales Identity Digital manages under an agreement with the government (New gTLDs & ccTLDs).
• .Brand: a TLD applied for by a company for its own brand, which can't be open to the public or run a sunrise and is a long operating commitment (New gTLDs & ccTLDs).
• .io (British Indian Ocean Territory): the ccTLD whose future became uncertain when the UK agreed to transfer sovereignty over the Chagos Archipelago, the example of a ccTLD's country code itself being at risk (New gTLDs & ccTLDs).
• ACPA in rem: an action under the US Anticybersquatting Consumer Protection Act against the domain name itself, filed where the registrar or registry is located when personal jurisdiction over the registrant can't be obtained (Domain Disputes).
• Actionable evidence: information readily available to the registrar sufficient to make a reasonable determination of DNS Abuse, the point from which prompt action is measured (DNS Abuse at the Registrar).
• Add Grace Period (AGP): the five days after a registration during which a registrar delete credits the fee, capped per registrar per month by the AGP Limits Policy since domain tasting (The Domain Lifecycle).
• AGP Limits Policy: the consensus policy that bars registries from refunding Add Grace Period deletes above a monthly threshold per registrar per TLD (The Domain Lifecycle).
• Alias record / CNAME flattening: provider features that answer at the zone apex with addresses resolved from a target name, working around the rule that a CNAME can't sit at the apex; they aren't zone data and don't transfer (DNS Hosting & DNSSEC).
• Ambiguous outcome: an EPP command with no or a malformed response, whose success must not be assumed and has to be resolved by asking the registry (The Domain Data Model & EPP).
• Apex CNAME problem: a CNAME can't coexist with other data, and the zone apex must hold SOA and NS records, so example.com itself can't be a CNAME to a load balancer or CDN (DNS Hosting & DNSSEC).
• Auth code (AuthInfo): the per-domain secret the registrant gives the gaining registrar to authorize a transfer, which RFC 9154 says should be random, set only during a transfer and stored by the registry only as a hash (Transfers, Locks & Registrar Security).
• Auto-Renew Grace Period: the period after expiry, when the registry has renewed the name automatically and billed the registrar, during which a registrar delete credits the renewal (The Domain Lifecycle).
• Backorder: an order with a service that tries to register a pending-delete name the moment it drops (The Domain Lifecycle).
• Bundled DNS: DNS given away free (Cloudflare, DigitalOcean, most registrars and hosts) as a way to win the zone for another product (DNS Hosting & DNSSEC).
• CDS and CDNSKEY: records a signed child zone publishes to tell its parent which DS to hold, so the parent can scan and update the DS automatically (DNS Hosting & DNSSEC).
• Change of Registrant: Part II of the Transfer Policy: a material change to a registrant's name, organization or email needs confirmation from both the prior and new registrant (Transfers, Locks & Registrar Security).
• Change of Registrant lock: the 60-day inter-registrar transfer lock imposed after a change of registrant unless the registrant opted out (Transfers, Locks & Registrar Security).
• Claims period: at least the first 90 days of general registration, when anyone registering a name matching a Trademark Clearinghouse mark gets a claims notice and the mark holder is told if they proceed (New gTLDs & ccTLDs).
• clientHold: the EPP status a registrar adds so the registry stops publishing the name in the DNS, its suspension lever for non-payment and abuse; nothing below the name resolves (DNS Abuse at the Registrar).
• Cloudflare Registrar: Cloudflare's retail registrar for its own customers, selling names at cost, at or below what registries and ICANN charge (ICANN, Registries & Registrars).
• Consensus policies: ICANN policies that bind registries and registrars through their contracts, such as the Transfer Policy, the ERRP, the AGP Limits Policy, the UDRP and the Registration Data Policy (ICANN, Registries & Registrars).
• Contact object: the EPP object (RFC 5733) for a person or organization, with a client-chosen ID, postal info, phone, email and an authInfo (The Domain Data Model & EPP).
• Contention (gTLD round): applicants for the same string in one set, resolved in the 2026 round only by ICANN's auction or Community Priority Evaluation, with private auctions barred (New gTLDs & ccTLDs).
• DNS Abuse: in the amended RAA and registry agreement, malware, botnets, phishing, pharming, and spam when it delivers one of the others (DNS Abuse at the Registrar).
• DNS failover: answering with a secondary when the primary's health check fails, bounded by caching because resolvers keep the cached answer until its TTL expires (DNS Hosting & DNSSEC).
• DNSSEC chain: a signed zone's DNSKEY and RRSIG records, its NSEC or NSEC3 denial records, and the DS at the parent that links its key into the chain of trust (DNS Hosting & DNSSEC).
• Domain object: the EPP object (RFC 5731) for a registered name, whose attributes a registrar mirrors into its own tables (The Domain Data Model & EPP).
• Domain tasting: registering names en masse, keeping the few that earned advertising revenue within the Add Grace Period and deleting the rest for a refund (The Domain Lifecycle).
• Drop catching: registering a name the instant the registry purges it, where the first create wins, which drop catchers pursue by multiplying accreditations to multiply connections (The Domain Lifecycle).
• DS record: the hash of a zone's key-signing key published at the parent, sent by the registrar to the registry over EPP's secDNS extension; a stale DS after a provider move is the most common DNSSEC outage (DNS Hosting & DNSSEC).
• EPDP: the expedited policy development process ICANN ran to replace the Temporary Specification, whose Phase 1 became the basis of the Registration Data Policy (Registration Data & RDAP).
• EPP: the Extensible Provisioning Protocol, the registry-registrar protocol (RFC 5730 and its object mappings) over TLS with mutual authentication (The Domain Data Model & EPP).
• Expired name auction: a registrar selling a name it still sponsors during the auto-renew grace period, which should wait until the standard renewal window closes (The Domain Lifecycle).
• Expired Registration Recovery Policy (ERRP): the consensus policy governing registrars between expiry and delete: notices before and after expiry, DNS interruption, and redemption (The Domain Lifecycle).
• External and internal hosts: EPP host objects outside the registry's namespace (external) or subordinate to a domain in the registry (internal), whose superordinate domain must be known to the registry (The Domain Data Model & EPP).
• Form of Authorization (FOA): the notice the losing registrar must send the registrant within 24 hours of a transfer request; the gaining registrar's FOA has gone unenforced since redaction hid the registrant's email (Transfers, Locks & Registrar Security).
• Host object: the EPP object (RFC 5732) for a nameserver, with a name, a ROID, statuses and any IP addresses (The Domain Data Model & EPP).
• ICANN accreditation fee: the fixed yearly fee each accredited registrar pays ICANN per accreditation (ICANN, Registries & Registrars).
• ICANN transaction fee: the per-transaction-year fee a registrar pays ICANN on each new registration, renewal and transfer (ICANN, Registries & Registrars).
• ICANN variable shared fee: a fixed yearly sum divided among all registrars, with forgiveness for qualified registrars (ICANN, Registries & Registrars).
• KSK, ZSK and CSK: DNSSEC keys: the key-signing key signs only the DNSKEY set and its hash is the DS at the parent, the zone-signing key signs everything else and rolls without the parent, and a combined signing key does both (DNS Hosting & DNSSEC).
• Launch phases: the sequence a new gTLD opens in: sunrise for trademark holders, claims notices, then general availability, often after an early-access period (New gTLDs & ccTLDs).
• Lock (UDRP): the state a registrar must apply within two business days of a provider's verification request, blocking any change of registrant or registrar while the proceeding runs (Domain Disputes).
• Lock (URS): the registry's lock within 24 hours of a URS complaint passing review, blocking all changes to the registration data, including transfer and deletion (Domain Disputes).
• Metered DNS: DNS priced by a small per-zone fee and a per-million query price, with premium query types for routing (Route 53, Google, Azure) (DNS Hosting & DNSSEC).
• Name-server reset: a registrar replacing a domain's host objects with its own so resolution moves to servers it controls, to serve a notice page or sinkhole (DNS Abuse at the Registrar).
• NetBeacon: a free, centralized abuse reporting service from the DNS Abuse Institute that standardizes and enriches reports and routes them to registrars (DNS Abuse at the Registrar).
• Notice of Breach: ICANN Compliance's formal breach notice with a cure deadline, the step before termination of a registrar's accreditation (ICANN, Registries & Registrars).
• Pending Delete Period: the days after redemption ends without a restore, during which nothing can be done before the registry purges the name and it becomes available (The Domain Lifecycle).
• Poll queue: the EPP message queue through which the registry tells the registrar about things it didn't do itself, such as transfer requests and registry actions (The Domain Data Model & EPP).
• Premium names: names a registry prices in higher tiers, often with premium renewals, breaking the flat registry fee (ICANN, Registries & Registrars).
• Primaries and secondaries: running a zone on two providers, one primary and one secondary pulling the zone by AXFR or IXFR on NOTIFY, with TSIG authenticating transfers (DNS Hosting & DNSSEC).
• RAA (Registrar Accreditation Agreement): the contract between ICANN and each accredited registrar, setting fees, registration agreement terms, records, abuse duties and termination grounds (ICANN, Registries & Registrars).
• RDAP: the Registration Data Access Protocol, HTTP and JSON lookups of registration data found through IANA bootstrap files, which replaced WHOIS as the definitive source for gTLD data (Registration Data & RDAP).
• RDAP bootstrap: IANA's JSON registries pairing TLDs, IP prefixes and AS ranges with base RDAP URLs, matched right to left with the longest match winning (Registration Data & RDAP).
• RDDS: registration data directory services: RDAP, and WHOIS where it still runs, which must publish the domain, registrar, abuse contacts, statuses, dates and nameservers (Registration Data & RDAP).
• Redacted member: the RFC 9537 RDAP extension that lists each redacted field with its name, a JSONPath to it and the redaction method (Registration Data & RDAP).
• Redemption Grace Period: the period after a registrar deletes a name outside the Add Grace Period, during which only the registrar can restore it (The Domain Lifecycle).
• Registrar lock: clientTransferProhibited, usually with update and delete prohibitions, set by the registrar and removable by the account holder; it stops accidental transfers but not anyone who can log in (Transfers, Locks & Registrar Security).
• Registration agreement: the contract between the registrar and its registrant, which must carry the terms the RAA and the registry require (ICANN, Registries & Registrars).
• Registration Data Policy: the consensus policy governing what registrars collect, transfer to registries, publish and redact, disclose on request and retain (Registration Data & RDAP).
• Registration Data Request Service (RDRS): ICANN's voluntary request router that passes disclosure requests to registrars that take part, deciding nothing and holding no data (Registration Data & RDAP).
• Registry agreement: the contract between ICANN and a registry operator, requiring every registration to go through an ICANN-accredited registrar with non-discriminatory access (ICANN, Registries & Registrars).
• Registry fee: the registry's wholesale price per name-year, paid by the registrar from its payment security at the transaction (ICANN, Registries & Registrars).
• Registry lock: the serverTransferProhibited, serverUpdateProhibited and serverDeleteProhibited statuses set by the registry, released only after an out-of-band check, which protect against a compromised registrar account (Transfers, Locks & Registrar Security).
• Registry Registrar Protocol (RRP): EPP's predecessor, a text protocol for the thin .com registry (ICANN, Registries & Registrars).
• Registry service provider (RSP): the company that operates a TLD's technical back end for the brand on the contract, a separate business from the registry (New gTLDs & ccTLDs).
• Registry-Registrar Agreement (RRA): the contract between a registry and each registrar covering the protocol, billing and the payment security that sets the registrar's credit (ICANN, Registries & Registrars).
• Renew/Extend Grace Period: the days after an explicit renewal during which a registrar delete credits the renewal fee (The Domain Lifecycle).
• Reseller (registrar): a seller of domain names under a wholesale registrar's accreditation, who pays no ICANN fees while the registrar answers to ICANN for it (ICANN, Registries & Registrars).
• Restore: recovering a name from redemption in two EPP steps, a restore request and then a restore report with the registration data before and after (The Domain Lifecycle).
• Result codes (EPP): four-digit EPP response codes whose first digit is success (1) or failure (2), which a registrar's code must branch on rather than on messages (The Domain Data Model & EPP).
• Routing policies: DNS answer strategies such as simple, weighted, latency, geolocation, geoproximity, IP-based, failover and multivalue, priced as premium query types (DNS Hosting & DNSSEC).
• SAC115: the Security and Stability Advisory Committee report proposing an interoperable approach to abuse handling, whose definition of DNS Abuse the contracts adopted (DNS Abuse at the Registrar).
• SC-085v2: the CA/Browser Forum ballot requiring CAs to validate DNSSEC, when present, for CAA and domain validation lookups, so a broken signed zone fails certificate issuance (DNS Hosting & DNSSEC).
• Sessions (EPP): EPP over TCP port 700 with TLS and mutual authentication, the registrar presenting a client certificate, under per-registry session limits (The Domain Data Model & EPP).
• Signed Mark Data (SMD): the file from the Trademark Clearinghouse that a trademark holder needs to register during sunrise (New gTLDs & ccTLDs).
• SOA record: the record at a zone's apex naming the primary server, contact, serial and the refresh, retry, expire and minimum timers (DNS Hosting & DNSSEC).
• Sunrise: the launch phase restricted to trademark holders with a Signed Mark Data file, before general registration opens (New gTLDs & ccTLDs).
• TDRP (Transfer Dispute Resolution Policy): the dispute policy for transfers, which only the gaining or losing registrar can file, with remedies that approve or reverse the transfer (Domain Disputes).
• Temporary Specification: the ICANN Board's 2018 interim rule that redacted personal data from public registration data for the GDPR, later replaced by policy from the EPDP (Registration Data & RDAP).
• Transaction identifiers (EPP): the client's <clTRID> and the server's <svTRID>, which together identify an EPP transaction and should both be logged and retained (The Domain Data Model & EPP).
• Transfer Authorization Code (TAC): the Transfer Policy Review's name for the auth code: generated only on request, one-time use, valid for a fixed life and announced to the registrant when issued (Transfers, Locks & Registrar Security).
• Transfer Grace Period: the days after a completed transfer during which a registrar delete credits the transfer fee (The Domain Lifecycle).
• Transfer Pending Period: the days after a transfer request during which the losing registrar may approve or deny; if it does neither, the registry approves automatically (The Domain Lifecycle).
• Transfer Policy: ICANN's consensus policy for inter-registrar transfers and changes of registrant, which gives registrants portability under fixed notice and approval clocks (Transfers, Locks & Registrar Security).
• Transfer Policy Review: the GNSO review whose recommendations, adopted by ICANN's Board, rename and tighten the auth code, drop the gaining FOA and rename the losing FOA a Transfer Confirmation (Transfers, Locks & Registrar Security).
• TTL: the time a resolver may cache a DNS record; a short TTL makes changes and failover fast and costs more queries (DNS Hosting & DNSSEC).
• UDRP: ICANN's Uniform Domain-Name Dispute-Resolution Policy, a mandatory administrative proceeding in which a trademark owner can win cancellation or transfer of a name, nothing else (Domain Disputes).
• UDRP elements: the three things a complainant must prove: the name is identical or confusingly similar to its mark, the registrant has no rights or legitimate interests, and the name was registered and used in bad faith (Domain Disputes).
• UDRP freeze: the bar on transferring a disputed name to another holder or registrar while a UDRP is pending and for a period after it concludes (Domain Disputes).
• UDRP providers: the approved dispute providers (ADNDRC, CIIDRC, the Czech Arbitration Court, Forum and WIPO) with which UDRP complaints are filed (Domain Disputes).
• UDRP wait: the ten business days a registrar waits after a decision ordering transfer or cancellation, implementing it unless the registrant shows a file-stamped court complaint (Domain Disputes).
• URS: the Uniform Rapid Suspension System, a faster, cheaper route for clear-cut infringement in new gTLDs, decided on clear and convincing evidence, with suspension as the only remedy (Domain Disputes).
• URS remedy: the registry suspending the name for the rest of its registration period and pointing its nameservers at the provider's informational page (Domain Disputes).
• WHOIS: the original public directory of registration data over TCP port 43, whose contractual obligation for gTLDs ended when RDAP became the definitive source (Registration Data & RDAP).
• Zone (DNS): a contiguous part of the DNS namespace served from one set of name servers, with a single SOA and NS records at its apex (DNS Hosting & DNSSEC).

Certificates#

• 24-hour and 5-day revocation deadlines: the BR deadlines for revoking a certificate: 24 hours for a subscriber request, key compromise or unreliable validation, 5 days for misuse, changed information or non-compliant issuance (Shorter Lifetimes, Revocation & Distrust).
• Account and method pinning (CAA): the RFC 8657 CAA parameters accounturi, which limits issuance to one ACME account, and validationmethods, which limits the validation methods allowed (The Web PKI & Certificate Transparency).
• ACME: the protocol a client uses to get certificates from a CA automatically: a directory, an account, an order with authorizations and challenges, then finalize and download (ACME & Certificates at Hosting Scale).
• ACME Renewal Information (ARI): RFC 9773's mechanism that moves the decision of when to renew from the client to the CA, which returns a suggested renewal window per certificate (ACME & Certificates at Hosting Scale).
• Agreed-Upon Change to Website: the BR validation methods that check a file on the website, under /.well-known/pki-validation or through ACME's http-01 (The Web PKI & Certificate Transparency).
• Amazon Trust Services: the CA behind AWS Certificate Manager, issuing free DV certificates for use on AWS services (The Web PKI & Certificate Transparency).
• AWS Certificate Manager (ACM): AWS's managed certificates from Amazon Trust Services, validated by DNS (with automatic renewal), email or HTTP through CloudFront, usable on AWS services (ACME & Certificates at Hosting Scale).
• Baseline Requirements (BRs): the CA/Browser Forum's shared floor of rules for publicly trusted TLS certificates, covering validation, lifetimes and revocation (The Web PKI & Certificate Transparency).
• CA distrust: a root program ceasing to trust a CA's roots, usually from a cutoff date keyed on the earliest SCT, so existing certificates keep working until expiry and renewals become the emergency (Shorter Lifetimes, Revocation & Distrust).
• ca_distrust_events: the table with one row per root program distrust decision (roots covered, basis, cutoff, effective date, source), with successor rows when a date moves (Shorter Lifetimes, Revocation & Distrust).
• CA/Browser Forum: the body in which issuers and browsers vote together on the TLS Baseline Requirements (The Web PKI & Certificate Transparency).
• CAA: a DNS record naming the CAs allowed to issue for a domain, with issue, issuewild and iodef tags, found by climbing from the requested name to each parent (The Web PKI & Certificate Transparency).
• Caddy: web server software many platforms embed, which obtains certificates over ACME from Let's Encrypt with ZeroSSL as fallback, including on demand at the first handshake (ACME & Certificates at Hosting Scale).
• Certificate Transparency (CT): public, append-only, untrusted logs of every publicly trusted certificate, which don't stop misissuance but make it impossible to hide (The Web PKI & Certificate Transparency).
• Certificates per registered domain: the Let's Encrypt rate limit that counts every name under one registered domain together, so a platform giving customers subdomains of its own domain shares one allowance (ACME & Certificates at Hosting Scale).
• Challenge (ACME): a way to satisfy an authorization, with a token and a status; the client publishes the response and tells the CA to check (ACME & Certificates at Hosting Scale).
• Cloud-managed DV: certificates a cloud or CDN issues and renews for its own services (ACM, a CDN's certificates), with no renewal work but usable only there (The Web PKI & Certificate Transparency).
• Consecutive authorization failures: the Let's Encrypt rate limit that pauses an identifier after repeated failed validations, punishing hosts that retry for domains pointed elsewhere (ACME & Certificates at Hosting Scale).
• CRLite: Firefox's compact, frequently refreshed encoding of every revoked certificate, downloaded by the browser instead of fetching CRLs per connection (Shorter Lifetimes, Revocation & Distrust).
• CRLs: lists of revoked serials a CA publishes for clients to download, and the only revocation data Let's Encrypt still publishes (Shorter Lifetimes, Revocation & Distrust).
• CRLSets: Chrome's browser-pushed set of revocations, covering a small share of all revocations (Shorter Lifetimes, Revocation & Distrust).
• DigiCert: a commercial CA selling DV, OV and EV certificates, with ACME through EAB credentials created per certificate type (The Web PKI & Certificate Transparency).
• Directory (ACME): the single ACME URL that lists the others (newNonce, newAccount, newOrder, revokeCert, keyChange) and a meta object, including whether external account binding is required (ACME & Certificates at Hosting Scale).
• DNS Change: the BR validation method in which the CA checks a random value in a CNAME, TXT or CAA record, the basis of ACME's dns-01 (The Web PKI & Certificate Transparency).
• DNS Labeled with Account ID: the BR validation method for ACME's draft dns-account-01 challenge, which can cover wildcards (The Web PKI & Certificate Transparency).
• DNS TXT Record with Persistent Value: the BR validation method of a standing TXT record at _validation-persist.<name> naming the CA and an account (The Web PKI & Certificate Transparency).
• dns-01: the ACME challenge answered with a TXT record at _acme-challenge.<name> holding a hash of the key authorization; the only challenge that covers wildcards (ACME & Certificates at Hosting Scale).
• dns-persist-01: an ACME challenge using a standing TXT record at _validation-persist.<name> that names the CA and the ACME account, so validation needn't be repeated per order (ACME & Certificates at Hosting Scale).
• DV from a free ACME CA: domain-validated certificates issued automatically for free, supported by every host, where one CA's outage or distrust hits every site on it (The Web PKI & Certificate Transparency).
• Earliest SCT: the timestamp Chrome keyed its Entrust distrust on, which the certificate carries and which a host can check only if it stored its certificates' SCTs (Shorter Lifetimes, Revocation & Distrust).
• External Account Binding (EAB): a key identifier and MAC key issued out of band that bind a new ACME account to a customer account the CA already has, required by commercial CAs and some free ones (ACME & Certificates at Hosting Scale).
• Finalize and download: the ACME step in which, once every authorization is valid, the client submits a CSR naming exactly the order's identifiers and downloads the certificate (ACME & Certificates at Hosting Scale).
• Google Trust Services: Google's CA, issuing free DV certificates through Google Cloud's Public CA over ACME with External Account Binding (The Web PKI & Certificate Transparency).
• http-01: the ACME challenge answered by serving a file at /.well-known/acme-challenge/<token> over HTTP, which validates exactly the requested name and can't cover a wildcard (ACME & Certificates at Hosting Scale).
• Key authorization: the string token || '.' || base64url(Thumbprint(accountKey)) that token-based ACME challenges build their response from, binding the proof to the account (ACME & Certificates at Hosting Scale).
• Let's Encrypt: ISRG's nonprofit CA issuing free DV certificates over ACME with no external account, the default CA almost everywhere (The Web PKI & Certificate Transparency).
• Maximum Merge Delay: the time within which a CT log promises, through an SCT, to include a submitted entry in its tree (The Web PKI & Certificate Transparency).
• Merkle tree (CT log): the structure of a CT log, whose signed tree head commits to its size and root hash, with inclusion and consistency proofs showing entries are present and the log only appends (The Web PKI & Certificate Transparency).
• Monitors and auditors: CT participants that read every new log entry to watch for certificates on names they care about, and check that logs behave honestly (The Web PKI & Certificate Transparency).
• Multi-perspective issuance corroboration: the BR rule that a CA repeat each validation and CAA check from several remote network perspectives and issue only if enough agree, against BGP hijacks (The Web PKI & Certificate Transparency).
• OCSP: the protocol in which a client asks the CA about one certificate's status, which leaks browsing to the CA and soft-fails when unreachable, and which Let's Encrypt has turned off (Shorter Lifetimes, Revocation & Distrust).
• OCSP stapling and Must-Staple: the server attaching a CA-signed OCSP response to the handshake, made mandatory by Must-Staple, which removes the privacy leak but has no place in defaults for CRL-only CAs (Shorter Lifetimes, Revocation & Distrust).
• On-demand issuance: obtaining a certificate at a TLS terminator during the first handshake for a name, which must be gated or it orders for any name a client sends (ACME & Certificates at Hosting Scale).
• Order (ACME): the ACME object created with newOrder for a list of identifiers, carrying status, expiry, authorizations and the finalize URL (ACME & Certificates at Hosting Scale).
• OV and EV: certificates that add vetted organization identity to domain control, putting identity in the certificate for those who check it, at the cost of manual vetting (The Web PKI & Certificate Transparency).
• Per-customer SAN bundle: one certificate covering all of a customer's names, convenient for panel accounts but one failing name blocks the renewal of all (ACME & Certificates at Hosting Scale).
• Precertificate: a certificate a CA logs before issuance, carrying a poison extension so no client accepts it, so the SCTs can be embedded in the real certificate (The Web PKI & Certificate Transparency).
• Preflight (ACME): checking from outside that a name points at the provider and that CAA allows its CA before creating an ACME order, so customer misconfiguration costs no failure budget (ACME & Certificates at Hosting Scale).
• Private CA: an organization's own root, trusted only by its devices, allowing any lifetime or internal name but not trusted by browsers (The Web PKI & Certificate Transparency).
• replaces: the ACME order field naming the certificate a new order succeeds, which the CA checks belongs to the same account (ACME & Certificates at Hosting Scale).
• Root program: a trust store with a policy attached, such as the Chrome Root Program, which enforces its rules by removing CAs (The Web PKI & Certificate Transparency).
• SC-081: the CA/Browser Forum ballot that set the schedule shortening certificate lifetimes and validation reuse periods in steps toward 47 days (Shorter Lifetimes, Revocation & Distrust).
• Sectigo: a commercial CA selling DV, OV and EV certificates under commercial accounts (The Web PKI & Certificate Transparency).
• Short-lived certificates: certificates that expire within days, replacing revocation because there is nothing to check (Shorter Lifetimes, Revocation & Distrust).
• Signed Certificate Timestamp (SCT): a CT log's immediate signed promise, with its log ID and a timestamp, to include a submitted certificate within its Maximum Merge Delay (The Web PKI & Certificate Transparency).
• Signed Tree Head: a CT log's periodic signature over its tree's size and root hash (The Web PKI & Certificate Transparency).
• Temporally sharded logs: CT logs that each accept only certificates expiring within a range of at most a year, so a log can be retired once everything in it has expired (The Web PKI & Certificate Transparency).
• TLS Using ALPN: the BR validation method behind ACME's tls-alpn-01 (The Web PKI & Certificate Transparency).
• tls-alpn-01: the ACME challenge answered in a TLS handshake on port 443 using a dedicated ALPN protocol (RFC 8737), suited to TLS-terminating proxies (ACME & Certificates at Hosting Scale).
• unknown_sct: the classification for a certificate whose SCTs were never parsed, which can't be judged against an SCT-keyed distrust rule and is treated as a finding (Shorter Lifetimes, Revocation & Distrust).
• Validation reuse period: how long a completed domain validation can back later certificates, shrinking in steps with certificate lifetimes (The Web PKI & Certificate Transparency).
• Wildcard certificate: a certificate covering one level of subdomains, which needs a DNS validation method and so ties wildcards to running the customer's DNS (ACME & Certificates at Hosting Scale).
• ZeroSSL: a CA issuing free DV certificates over ACME with EAB credentials and paid certificates through its API (The Web PKI & Certificate Transparency).

The Edge#

• 0-RTT: TLS 1.3 early data that lets a returning client send a request in its first flight, which can be replayed, so it stays off until the origin handles replay (TLS & Protocols at the Edge).
• 421 Misdirected Request: the status a server returns when a request arrives on a reused connection it doesn't want to serve for that hostname (TLS & Protocols at the Edge).
• 425 Too Early: the status an origin returns for a request sent as early data that it won't risk replaying (TLS & Protocols at the Edge).
• AI traffic monetization: AWS WAF's feature on CloudFront that answers a monetized resource with a 402 carrying pricing and accepted payment networks, so crawlers can pay for access (WAF, Bots & Rate Limits).
• Akamai (Prolexic): Akamai's DDoS scrubbing network, receiving customer traffic by routed GRE or BGP diversion, cleaning it and forwarding the rest (DDoS Mitigation).
• Alt-Svc discovery: how a client learns that an edge offers HTTP/3: the first TCP response advertises it in an Alt-Svc header, or an HTTPS DNS record announces it (TLS & Protocols at the Edge).
• Amazon CloudFront: AWS's CDN, sold pay as you go, on flat-rate plans or with a savings bundle, with DNS-based steering to its POPs (The Edge Business).
• Amplification limits (QUIC): QUIC's rule that a server may send only a small multiple of the bytes it received before the client's address is validated, which stops it being used as a reflector (TLS & Protocols at the Edge).
• Anomaly scoring: the OWASP Core Rule Set's approach in which matching rules add their severity to a running score instead of blocking, and the request is blocked only when the score crosses a threshold (WAF, Bots & Rate Limits).
• Anycast: every location announcing the same addresses in BGP so internet routing picks the location for each packet, which spreads attacks across locations (Networks, Peering & IP Addresses).
• Attestation (bots): a device vendor vouching for a client instead of the site interrogating it, as with Private Access Tokens (WAF, Bots & Rate Limits).
• Authenticated origin pulls: mutual TLS from edge to origin, the edge presenting a client certificate so the origin can prove a request came through the edge (TLS & Protocols at the Edge).
• AWS Shield: AWS's DDoS protection: Standard on CloudFront, Route 53 and load balancers at no charge, Advanced per payer account with credits for attack-driven charges (DDoS Mitigation).
• AWS WAF: AWS's WAF of web ACLs made of rules and rule groups (AWS Managed Rules, Marketplace sellers, the customer's own), measured in WCUs (WAF, Bots & Rate Limits).
• Azure DDoS Protection: Azure's L3/4 DDoS protection, sold per virtual network (Network Protection) or per public IP (IP Protection) (DDoS Mitigation).
• Azure Front Door: Microsoft's CDN and edge, sold in Standard and Premium tiers plus usage (The Edge Business).
• Azure Front Door WAF: Front Door's WAF of a Default Rule Set with anomaly scoring, a Bot Manager rule set and custom rules, with a Detection mode before blocking (WAF, Bots & Rate Limits).
• BCP 38: the practice of a network dropping outgoing packets whose source address isn't one of its own prefixes, which eliminates source address spoofing at its origin (DDoS Mitigation).
• BGP diversion: a protector announcing a customer's own prefix from its network so all its traffic passes through scrubbing, always on or only during an attack (DDoS Mitigation).
• Bot score: a per-request likelihood of automation computed from many signals, against which customers write rules; the scales differ by provider (WAF, Bots & Rate Limits).
• Bought IPv4: IPv4 space transferred through an RIR and owned, which amortizes against leasing (Networks, Peering & IP Addresses).
• Bunny: a low-cost CDN priced per GB by region on a standard network or flat on a volume network, with no request fees (The Edge Business).
• Bunny (Shield): Bunny's edge security product combining WAF, rate limiting, bot detection and DDoS protection at the CDN edge (DDoS Mitigation).
• BYOIP: bringing a customer's own IP prefix to a provider, which announces it once control is proven through the RIR's records and a letter of authorization is on file (Networks, Peering & IP Addresses).
• Byte hit ratio: bytes served from cache over bytes served, the hit ratio that maps to the origin's egress bill (Caching & Invalidation).
• Cache key: what makes two requests the same cached object (host, scheme, query strings, headers, cookies, device class), kept separate from what is forwarded to the origin (Caching & Invalidation).
• Cache poisoning: an attack that sends an input the cache doesn't key on but the origin reflects, so a harmful response is cached and served to everyone (Caching & Invalidation).
• Cache policy: CloudFront's object defining the cache key, paired with an origin request policy for what the origin receives (Caching & Invalidation).
• Carpet bombing: a flood spread across many destination addresses or ports so per-target thresholds don't trip (DDoS Mitigation).
• Characteristics (rate limiting): the key a rate-limiting rule counts by, such as IP, ASN, country, header, cookie, path, JA3/JA4 or a body field (WAF, Bots & Rate Limits).
• Cloud-attached CDN: a CDN in front of the same cloud's origins (CloudFront, Cloud CDN, Front Door), with free or cheap origin fill (The Edge Business).
• CloudFront flat-rate plans: CloudFront plans that bundle CDN, WAF, DDoS protection, DNS and edge compute per distribution for a monthly price with request and transfer allowances (The Edge Business).
• CloudFront Security Savings Bundle: a one-year monthly spend commitment that discounts all CloudFront usage, including Functions and Lambda@Edge, and includes AWS WAF usage (The Edge Business).
• Clustering: forwarding each object's fetch to the one server in a POP responsible for it, so request collapsing works across the whole POP (Caching & Invalidation).
• Connection reuse (coalescing): a client sending requests for another hostname over an existing HTTP/2 or HTTP/3 connection when the server's certificate is authoritative for it (TLS & Protocols at the Edge).
• Contract with commitment: CDN pricing at a negotiated rate with a minimum commitment (Akamai, enterprise tiers everywhere) (The Edge Business).
• Counters are local: edge rate-limit counters are kept per data center, so a limit applies per location a client reaches, not across the network (WAF, Bots & Rate Limits).
• Credited after the fact: the DDoS billing model in which attack-driven charges are billed and then credited on request (AWS Shield Advanced, Azure DDoS Network Protection) (DDoS Mitigation).
• Custom hostnames for SaaS: an edge product that terminates TLS for a SaaS platform's customers' own domains under the platform's account, through claim, proof of control, issuance, serving and release (TLS & Protocols at the Edge).
• Custom rules (WAF): the customer's own WAF rules: IP and country lists, path and header matches, size constraints, method restrictions and bot conditions (WAF, Bots & Rate Limits).
• Dedicated IP certificates: one address per certificate for clients that don't send SNI, sold at a high monthly price (TLS & Protocols at the Edge).
• DNS-based steering: the provider's authoritative DNS answering each lookup with the address of a location chosen for the resolver that asked (Networks, Peering & IP Addresses).
• Edge assembly: caching page fragments separately and assembling them per request at the edge (ESI or edge functions), so personal pages can still use the cache (Caching & Invalidation).
• Edge compute: code run at the CDN's locations, priced on requests and CPU time rather than bytes, the revenue line every edge provider is growing into (The Edge Business).
• Egress can't be anycast: traffic an edge sends on a customer's behalf needs replies to return to the sending server, so it can't use anycast addresses (Networks, Peering & IP Addresses).
• Embedded capacity: a content network's servers placed inside an access network, so traffic never crosses an interconnect, serving only that network's customers (Networks, Peering & IP Addresses).
• Exceptions (WAF): rules that skip a managed rule for a given path or condition, taking priority over overrides (WAF, Bots & Rate Limits).
• Excluded at metering: the DDoS billing model in which attack traffic never reaches the bill because it is excluded before rating (Fastly DDoS Protection) (DDoS Mitigation).
• Executing and blocking paranoia levels: CRS's separation of the level of rules that run from the level that counts toward the anomaly score, so higher-level rules can be measured before they block (WAF, Bots & Rate Limits).
• Fastly packages: Fastly's monthly-priced bundles with included requests, turning usage into a fixed price (The Edge Business).
• Flat-rate plan (CDN): a monthly price with allowances instead of metered bytes and requests (Cloudflare, CloudFront flat rate, Fastly packages), limited by a content rule rather than a meter (The Edge Business).
• Google Cloud Armor: Google's protection at its edge in front of its load balancers, automatic at L3/4 and with security policies and preconfigured WAF rules at L7 (DDoS Mitigation).
• Google Cloud CDN: Google's CDN behind the global external Application Load Balancer, on global anycast addresses, billed by usage (The Edge Business).
• Google Global Cache: Google's embedded caches, for which Google provides the hardware and the ISP provides space, power, a connection and a BGP feed (Networks, Peering & IP Addresses).
• Hijack (routing): a network originating a prefix it doesn't hold, redirecting traffic for someone else's addresses (Networks, Peering & IP Addresses).
• Hit-for-pass: a marker left when a response can't be shared, so later requests stop queueing behind a collapsed fetch (Caching & Invalidation).
• HTTP/2 Rapid Reset: an attack that opens and immediately cancels HTTP/2 streams, so the server does work for each while cancelled streams don't count against the concurrency limit (DDoS Mitigation).
• Invalidation (Cloudflare): Cloudflare's soft purge, which marks content stale so it is revalidated on the next request and reused if unchanged (Caching & Invalidation).
• Invisible challenges: bot checks run as small JavaScript probes without a puzzle, such as Turnstile (WAF, Bots & Rate Limits).
• IoT botnets: botnets of compromised real devices that complete handshakes, such as Mirai, which made attack sources look like ordinary clients (DDoS Mitigation).
• IPv6-first with shared IPv4: IPv6 everywhere and IPv4 only shared or by SNI, which removes most address cost (Networks, Peering & IP Addresses).
• Leak (routing): a network passing on routes it should have kept to itself (Networks, Peering & IP Addresses).
• Leased IPv4: IPv4 addresses rented from a holder, with no capital outlay but the lessor's reputation history inherited (Networks, Peering & IP Addresses).
• Low-cost per-GB network: a CDN selling very low per-GB prices with no request fees (Bunny standard and volume) (The Edge Business).
• Managed rulesets: WAF rules written and updated by the provider or a third-party seller, which the customer controls only through overrides and exceptions (WAF, Bots & Rate Limits).
• MANRS: a routing-security initiative supported by the Global Cyber Alliance, asking networks to take four actions starting with filtering (Networks, Peering & IP Addresses).
• Match Viewer: CloudFront's origin protocol setting under which one cached copy serves both HTTP and HTTPS requests (Caching & Invalidation).
• Metered usage (CDN): CDN pricing per GB by region and volume tier plus requests (CloudFront, Fastly, Cloud CDN, Front Door) (The Edge Business).
• Mitigation timeout: how long a rate-limiting rule's action lasts once it triggers (WAF, Bots & Rate Limits).
• Multi-CDN: traffic split across two or more CDNs by a steering layer, for price leverage and resilience (The Edge Business).
• Net retention: revenue from last year's customers now over their revenue then, a metric each edge provider defines its own way (The Edge Business).
• Netflix Open Connect: Netflix's program offering ISPs free embedded appliances in their data centers or peering at exchanges (Networks, Peering & IP Addresses).
• Never metered: the DDoS billing model in which attack size can't affect price because bandwidth isn't the plan's meter (Cloudflare plans) (DDoS Mitigation).
• Origin certificates: certificates from a provider-run private CA for the edge-to-origin leg, valid only between the edge and the origin (TLS & Protocols at the Edge).
• Origin fill: the transfer from origin to edge when the cache misses, billed by some providers and free from same-cloud origins at others (The Edge Business).
• Origin offload: one minus origin requests (or bytes) over edge requests (or bytes), the metric that maps to origin capacity (Caching & Invalidation).
• Origin request policy: CloudFront's object defining what the origin receives, separate from the cache key (Caching & Invalidation).
• Override (WAF): the customer's control over a managed ruleset, changing an action or disabling rules at the ruleset, tag or rule level rather than editing the rules (WAF, Bots & Rate Limits).
• Own delivery network: caches in rented colocation and inside access networks, the lowest-cost delivery for the largest content companies (The Edge Business).
• Paranoia levels: the OWASP CRS setting that decides which rules run, from level 1 baseline protection with few false positives to level 4 for critical assets (WAF, Bots & Rate Limits).
• Pay per crawl: Cloudflare's feature letting a publisher Allow, Charge or Block each crawler with a flat per-request price, Cloudflare acting as Merchant of Record (WAF, Bots & Rate Limits).
• Peering: two networks exchanging traffic between their own customers directly, usually settlement-free, at exchanges or over private interconnects (Networks, Peering & IP Addresses).
• PeeringDB: the free public directory, run by volunteers, where networks publish their ASNs, peering policies, exchanges and facilities (Networks, Peering & IP Addresses).
• POP counts: the location numbers CDNs publish, which don't compare because units, designs and capacity claims differ, so they are treated as claims (Networks, Peering & IP Addresses).
• Pricing region: the region delivery is priced by, where the serving location sits, the main driver of CDN cost (The Edge Business).
• Private network interconnect (PNI): a dedicated cable between two networks' routers in the same building, used when traffic between them is large enough to fill ports (Networks, Peering & IP Addresses).
• Purge methods: the ways an edge invalidates cached content: by URL, tag (surrogate key), prefix, hostname or everything (Caching & Invalidation).
• Reflection and amplification: an attack sending small UDP requests with the victim's address forged as the source, so third-party servers send their larger answers to the victim (DDoS Mitigation).
• Remote signing (Keyless): running the TLS handshake's private-key operation on the customer's own key server, so the edge never holds the key (TLS & Protocols at the Edge).
• Remotely triggered blackholing (RTBH): the attacked network announcing the target address with the BLACKHOLE community so neighbors drop all traffic to it, which protects shared links but takes the address offline (DDoS Mitigation).
• Request collapsing: an edge holding concurrent requests for the same cache key while the first fetch is in flight and answering them all from one response (Caching & Invalidation).
• Request hit ratio: edge hits over all cacheable requests, inflated by collapsed requests and tiny objects (Caching & Invalidation).
• Revalidation: replacing a full fetch with a conditional one (If-None-Match or If-Modified-Since) that the origin answers with a 304 and no body when unchanged (Caching & Invalidation).
• Route origin validation: routers checking each BGP announcement against validated ROAs and marking it valid, invalid or not found (Networks, Peering & IP Addresses).
• RPKI and ROAs: the resource PKI in which an address holder signs a Route Origin Authorization allowing a single AS to originate routes to its prefixes, with an optional maximum length (Networks, Peering & IP Addresses).
• Scrubbing centers: a few large locations with filtering capacity that receive a customer's traffic, clean it and forward the remainder (DDoS Mitigation).
• Shield (origin shield): an upper cache tier near the origin that edge caches ask first, so the origin sees roughly one miss in total, at an extra per-request charge at some providers (The Edge Business).
• SNI: the TLS extension that lets clients reach many virtual servers on one address, so the edge picks the certificate and per-hostname settings by name (TLS & Protocols at the Edge).
• Soft versus hard purge: a hard purge makes objects unusable so the next request goes to the origin; a soft purge marks them stale so they can still be served while revalidating or when the origin is down (Caching & Invalidation).
• Soft-unicast: Cloudflare's egress design of one IPv4 address per data center shared by its servers through port slicing (Networks, Peering & IP Addresses).
• Stale serving: serving an expired copy for availability, with stale-while-revalidate refreshing it in the background and stale-if-error covering origin errors (Caching & Invalidation).
• SYN cache: a SYN-flood defense that keeps a small hashed table of half-open connections and evicts the oldest per bucket (DDoS Mitigation).
• SYN cookie: a SYN-flood defense in which the server allocates nothing for a half-open connection and encodes what it needs in the sequence number it sends back (DDoS Mitigation).
• SYN flood: an attack that sends SYNs, usually spoofed, and never completes the handshake, filling the backlog so real clients can't connect (DDoS Mitigation).
• Throttle versus block: the rate-limiting choice between allowing requests up to the limit and acting on the excess, and blocking a client entirely once it crosses the threshold (WAF, Bots & Rate Limits).
• Tiered caches: a second cache tier the edge caches ask before the origin, cutting origin load but making purges cover two tiers and adding inter-tier traffic to the bill (Caching & Invalidation).
• TLS fingerprints: identifiers of client software from how it opens a TLS connection, such as JA3's hash of the ClientHello and JA4's sorted variant (WAF, Bots & Rate Limits).
• TLS terminated at the origin: L4 pass-through in which the edge forwards TCP or QUIC without decrypting, so the edge can't cache or inspect (TLS & Protocols at the Edge).
• Transit: paying an upstream network to carry traffic to every destination on the internet, universal and simple but billed by capacity used (Networks, Peering & IP Addresses).
• UDP flood: a volumetric attack of UDP packets with any payload to any port, which needs no handshake and fills the target's link (DDoS Mitigation).
• Vary: the origin's response header naming which request headers changed the response, so the cache keeps separate variants (Caching & Invalidation).
• Verified bots: the allowlist of bots transparent about who they are and what they do, verified by published IP lists, reverse DNS or Web Bot Auth (WAF, Bots & Rate Limits).
• Versioned URLs: content-hashed asset names with long lifetimes that are never purged, preferred over invalidation for deploys because they also reach browser and proxy caches (Caching & Invalidation).
• Virtual patching: a WAF rule matching an exploit's shape, shipped in a managed ruleset with a default action to buy time for the real fix, which it never replaces (WAF, Bots & Rate Limits).
• Volume tier: the falling per-GB price bands within a month at most CDNs (The Edge Business).
• Web Bot Auth: a scheme in which a crawler signs each request with HTTP Message Signatures so the edge can know who it is, which charging for crawls requires (WAF, Bots & Rate Limits).
• Web cache deception: an attack that gets a logged-in victim to open a private page under a static-looking suffix (such as /account/foo.css), so the edge caches and shares the private response (Caching & Invalidation).

Communications Platforms#

• 10DLC (A2P ten-digit long code): registration for application-to-person texting from ordinary local numbers, in which every sender registers a brand and a campaign before carriers accept its traffic (Business Texting Registration).
• 8-bit data encoding: the SMS encoding for binary payloads, 140 octets in a single segment and 134 per concatenated segment, rare in application-to-person traffic (Sending a Text).
• 911 for VoIP: the duty of interconnected VoIP to carry emergency calls with a location dispatchers can use, which a platform meets by validating an emergency address when it is set, not when the call is made (911, CPNI & Telecom Duties).
• Account-level thresholds: pausing a whole customer account when its bounce or complaint rate crosses a limit; simple, but a broadcast problem then stops password resets (Inbox Rules).
• Aging (phone numbers): the rest a released number takes before returning to inventory, so calls, texts and reputation meant for the last holder fade first; the period is a published rule per number type (Phone Numbers & Porting).
• Alphanumeric sender ID: a brand name of up to 11 letters, digits and spaces shown as the sender of a one-way text, registered in advance in many countries and not supported in the US (WhatsApp & Messaging Apps).
• Apple Messages for Business: Apple's business chat in the Messages app, reached only through an Apple-approved Messaging Service Provider, in which the business may only reply to a conversation the customer started (WhatsApp & Messaging Apps).
• Attestation (A, B, C): the STIR/SHAKEN level an originating provider signs onto a call: A (full) when it knows the customer and the customer's right to the number, B (partial) when it knows only the customer, C (gateway) when it can't authenticate the source (Voice Platforms).
• Authentication+: The Campaign Registry's check that the person registering a brand actually controls it, billed per attempt including failed ones (Business Texting Registration).
• Authentication-international rate: Meta's higher price for authentication messages sent by a business based in another country to users in listed markets, once it passes 750,000 qualifying messages in 30 days (WhatsApp & Messaging Apps).
• BIMI (Brand Indicators for Message Identification): the standard that shows a sender's logo next to authenticated mail, requiring DMARC at enforcement, a VMC or CMC certificate and an SVG Tiny PS logo (Inbox Rules).
• Blocklist (email): a list of IPs and domains that many receivers consult, such as Spamhaus's SBL, XBL, CSS, PBL, ZEN and DBL; a listing of a shared IP blocks every customer on it (Inbox Rules).
• Blocks (email): a third delivery outcome, distinct from hard and soft bounces, caused by the sender's own authentication or reputation; a block never creates a suppression of the recipient's address (Email Sending Platforms).
• Brand (10DLC): the registration record of who is sending, tied to a tax identity, legal name, address, website and entity type, under which campaigns and numbers sit (Business Texting Registration).
• Branded calling: a verified name, logo and call reason added to the called party's display; for the provider it is a vetting workflow plus signing with extra claims, shown only on networks that have joined (Voice Platforms).
• Bring your own number (hosted messaging): text-enabling a number whose voice service stays with its existing carrier, which needs the number owner's recorded authorization and no port (Phone Numbers & Porting).
• Business portfolio (Meta): the business itself in Meta's hierarchy, above its WhatsApp Business Accounts and numbers, where business verification and the messaging limit are set (WhatsApp & Messaging Apps).
• Call labeling: the "Spam Likely" style labels a terminating carrier and its analytics vendor attach to calls from patterns, complaints and attestation, which an originating provider can't buy its customers out of (Voice Platforms).
• Campaign (10DLC): the registration record of what is sent: use case, description, sample messages, opt-in method, opt-out and help replies and content flags; each number belongs to one campaign at a time (Business Texting Registration).
• The Campaign Registry (TCR): the registry through which 10DLC brands and campaigns are registered and vetted, part of the private regime run by carriers and written down in CTIA's guidelines (Business Texting Registration).
• Campaign Service Provider (CSP): a platform registered with The Campaign Registry that submits its customers' brands and campaigns, its dashboard a front end for review queues it can't speed up (Business Texting Registration).
• Carrier fee (pass-through): the recipient carrier's surcharge on each message, billed to the customer as a pass-through line that raises revenue and cost by the same amount and so lowers the margin percentage (The CPaaS Business).
• carrier_fee_rules: the effective-dated table of carrier surcharges keyed by carrier, direction, number type, channel and registration status, so a new carrier fee shape is a row rather than code (The CPaaS Business).
• carrier_limits: the throughput each carrier granted a brand or campaign at approval, stored as granted because the sender enforces those numbers, not the vetting score (Business Texting Registration).
• Channel fallback: trying an app channel first and sending by SMS when it isn't delivered, which needs consent and registration for each channel and linked attempts to avoid double delivery (WhatsApp & Messaging Apps).
• CMC (Common Mark Certificate): a BIMI certificate type that doesn't require a registered trademark, displayed without the verified checkmark Gmail shows for VMCs (Inbox Rules).
• Contribution factor (USF): projected Universal Service program costs divided by projected contributable revenue, set quarterly and applied as a percentage of a provider's interstate and international end-user revenue (911, CPNI & Telecom Duties).
• Conversion monitoring: tracking codes sent against codes verified per country and prefix, and throttling a destination for a customer when conversion falls, the main detector of SMS pumping (Telecom Fraud).
• Country allowlist (geo permissions): sending texts or calls only to countries the customer serves, defaulting to the home country, the cheapest and most immediate control against pumping and revenue share fraud (Telecom Fraud).
• CPaaS (communications platform as a service): a provider that rents phone numbers and carries texts, calls and email for other companies through an API, billed by the unit (The CPaaS Business).
• CPNI (customer proprietary network information): what a carrier knows about a customer's use of its service (call detail records, numbers called, services subscribed), released only after authentication and certified as protected every year (911, CPNI & Telecom Duties).
• CPNI annual certification: the compliance certificate an officer signs each year under 47 CFR 64.2009(e), stating the provider's procedures, actions against data brokers and a summary of complaints (911, CPNI & Telecom Duties).
• Customer service window: the 24 hours after a user messages or calls a WhatsApp business, reset by each new message, during which free-form messages are allowed; outside it only approved templates (WhatsApp & Messaging Apps).
• Dedicated IP (email): an IP that carries one sender's traffic, so its reputation is that sender's alone: better for a large consistent sender, worse for a small or irregular one that never builds history (Email Sending Platforms).
• Deferral: a 4yz SMTP reply that slows a sender down; a rising deferral rate at one mailbox provider is the earliest sign of a reputation problem on an IP or domain (Inbox Rules).
• Delivery receipt (DLR): the asynchronous report from a carrier or upstream of what happened to a message, sometimes per segment, sometimes late and occasionally never; kept raw and mapped to the platform's own codes (Sending a Text).
• Destination prefix blocking: blocking number ranges that show fraud patterns across all customers, kept private because a published list tells fraudsters which ranges are open (Telecom Fraud).
• Direct-connect aggregator: a CPaaS with contracts and SMPP or SIP connections to many carriers, giving breadth across countries and the ability to route around a failed or expensive carrier (The CPaaS Business).
• DLT (India): the operators' registration platform under TRAI's rules, in which senders register as entities with headers, content templates and consent templates that every message must reference (WhatsApp & Messaging Apps).
• DMARC at enforcement: a DMARC policy of p=quarantine or p=reject (Gmail also wants pct=100), the precondition for BIMI (Inbox Rules).
• ESP (email service provider): a platform that sends email for other companies and whose product is reputation, pooled and divided across shared IPs, dedicated IPs, streams and onboarding (Email Sending Platforms).
• Feedback loop: a mailbox provider's program that reports recipients' spam complaints back to the sender, such as Yahoo's Complaint Feedback Loop and Microsoft's JMRP; enrollments expire and need tracking (Inbox Rules).
• Feedback-ID: the Gmail header that carries customer and campaign identifiers so Postmaster Tools can attribute complaint rates to them (Inbox Rules).
• Firm Order Commitment (FOC): the losing provider's confirmation of a port date after validating a Local Service Request (Phone Numbers & Porting).
• Form 499-A: the yearly FCC revenue report on which telecommunications and VoIP providers base Universal Service contributions (911, CPNI & Telecom Duties).
• Free entry point window: the window opened when a user arrives from a click-to-WhatsApp ad, in which Meta doesn't charge for template or service messages (WhatsApp & Messaging Apps).
• Google Business Messages: Google's business chat, whose Business Profile chat features ended on July 31, 2024, the category's example of an owner withdrawing a channel (WhatsApp & Messaging Apps).
• Growth numbering: applying for more numbering resources, which needs a Months-to-Exhaust Worksheet of utilization by rate center and caps inventory per rate center (Phone Numbers & Porting).
• GSM-7: the default SMS encoding, 160 characters in one segment and 153 per concatenated segment, used when every character is in the GSM 7-bit alphabet (Sending a Text).
• Hard bounce: a permanent delivery failure (the address doesn't exist or will never accept mail, an SMTP 5yz for the recipient), which suppresses the address for the sender and counts toward its bounce rate (Email Sending Platforms).
• HELP keyword: the inbound keyword the platform answers with the campaign's registered help text (Sending a Text).
• Human Agent tag: Meta's tag letting a person at the business reply on Messenger or Instagram up to 7 days after the user's message, outside the standard 24-hour window (WhatsApp & Messaging Apps).
• Ineligibility for mitigation: Gmail's refusal to help bulk senders above a spam-rate threshold fix delivery problems, the top rung of its enforcement ladder (Inbox Rules).
• IP pool: a group of sending IPs (shared, dedicated or managed dedicated) for a traffic class; shared pools are tiered new, trusted and quarantine so one sender's problem doesn't spread (Email Sending Platforms).
• IRSF (international revenue share fraud): the voice counterpart of SMS pumping: calls pumped to premium or high-cost numbers abroad whose termination revenue is shared with the fraudster (Telecom Fraud).
• ISV model (texting): a software platform registering each of its customers as its own brand under one account, attesting for their details, with a number per customer because a number belongs to one campaign (Business Texting Registration).
• JMRP (Junk Email Reporting Program): Microsoft's complaint feedback loop, part of SNDS, which reports when Outlook.com users mark a sender's mail as junk (Inbox Rules).
• Kakao AlimTalk: Kakao's informational business messages, sent through official dealers on Kakao-approved templates, including to users who haven't added the channel (WhatsApp & Messaging Apps).
• Kari's Law: the federal rule for multi-line telephone systems (offices, hotels, campuses, and hosted or cloud PBXs) requiring direct 911 dialing and notification (911, CPNI & Telecom Duties).
• Local Service Request (LSR): the gaining provider's port request to the losing provider, validated against the customer's account and either confirmed with a date or rejected with a code (Phone Numbers & Porting).
• Low-Volume Standard brand: a 10DLC brand type with a tax ID, up to five campaigns and a low daily cap on T-Mobile, for senders with small volumes (Business Texting Registration).
• Mailbox provider: a receiver such as Gmail, Yahoo or Outlook.com that decides what reaches the inbox and judges an ESP's IPs and its customers' domains by everyone who sends through them (Email Sending Platforms).
• Message lifecycle (SMS): accepted, queued, sent, delivered, and undelivered or failed, each status carrying the message ID and a sequence number so an older status can be discarded (Sending a Text).
• Message stream: a separation of transactional and broadcast mail onto their own IP pools and suppression lists, as in Postmark's Message Streams, so marketing can't spoil receipts (Email Sending Platforms).
• Message template (WhatsApp): a pre-registered message with placeholders, categorized as marketing, utility or authentication and reviewed by Meta, the only kind a business may send outside a customer service window (WhatsApp & Messaging Apps).
• message_templates: the table of pre-registered messages across WhatsApp, Kakao AlimTalk and India's DLT, with the category in force and an append-only history of reviews and recategorizations (WhatsApp & Messaging Apps).
• Messaging limit (WhatsApp): the number of unique users a business portfolio may reach outside customer service windows in a rolling 24 hours, from 250 up to unlimited (WhatsApp & Messaging Apps).
• MLTS (multi-line telephone system): a phone system serving many lines in an office, hotel or campus, including the hosted and cloud PBXs a platform runs, covered by Kari's Law (911, CPNI & Telecom Duties).
• NANP number: a ten-digit number in the North American Numbering Plan: a three-digit area code (NPA), a three-digit central office code (NXX) and a four-digit line number (Phone Numbers & Porting).
• Non-fixed VoIP: service the user can move (a softphone, mobile app or laptop client), for which the provider must supply automated dispatchable location where technically feasible (911, CPNI & Telecom Duties).
• Number lifecycle: available, reserved, assigned, ported out or released, aging, quarantined and returned; an assigned number is a held phone_number resource and inventory nobody holds lives in its own table (Phone Numbers & Porting).
• Official Business Account: a WhatsApp business number shown with a blue checkmark beside its name (WhatsApp & Messaging Apps).
• Onboarding and vetting (email): constraining who may send at all (a sandbox, a review, a daily cap) because an ESP's reputation is the sum of its customers' (Email Sending Platforms).
• Opt-out at the platform: suppressing a recipient after STOP at the platform as a backstop, while still forwarding the message so the customer's consent ledger stays the system of record (Sending a Text).
• Origination (voice): inbound calls to the customer's numbers arriving at the provider from the public network and sent to the customer's SIP endpoint or application (Voice Platforms).
• Owned network: a CPaaS model holding carrier authorization, its own numbering, switches and interconnects, for lower cost per unit and control of porting at the price of every telecom duty (The CPaaS Business).
• Per-message pricing (WhatsApp): Meta's model since July 1, 2025: a charge per delivered template by category and market, with service messages free up to a monthly tier per number (WhatsApp & Messaging Apps).
• Port-out lock: a customer-controlled switch that refuses port-out requests until turned off from an authenticated session, with notice (Phone Numbers & Porting).
• Port-out PIN: a secret set by the customer per account or number, stored as a hash and required on every port-out validation, so support sees only that validation failed (Phone Numbers & Porting).
• Porting: moving a number's service from one carrier to another; simple wireline and intermodal ports complete within one business day and non-simple ports within four under 47 CFR 52.35 (Phone Numbers & Porting).
• Postmaster Tools: Gmail's sender dashboard reporting spam rate and bulk-sender compliance, with an API a platform can poll for every customer domain (Inbox Rules).
• Pre-send gating: blocking bulk sending from domains that lack aligned DMARC and one-click unsubscribe, preventing rejections instead of reacting to them, with checks that rerun as DNS changes (Inbox Rules).
• Prepaid balance: a CPaaS account's funds kept as a sum of ledger entries with the recharge that funded them, never as a cached number, so a double charge can be proved or disproved (The CPaaS Business).
• Quality rating (WhatsApp): Meta's rating of a number or template from recipients' reactions, which gates messaging limit increases and can pause templates (WhatsApp & Messaging Apps).
• Quarantined number: a number tied to abuse, a carrier complaint or a law enforcement request, held out of inventory until a person clears it with a reason (Phone Numbers & Porting).
• Rate center: the geographic unit that decides whether a call is local; carriers get numbers in blocks per rate center, and utilization is measured by it (Phone Numbers & Porting).
• RCS (Rich Communication Services): business messaging with branding, rich cards, suggested replies and read receipts in the phone's default messaging app, falling back to SMS where unavailable (Business Texting Registration).
• Rejection (email): a 5yz SMTP reply that refuses the message, such as Outlook.com's 5.7.515 for failed authentication (Inbox Rules).
• Representative volume: SES's per-account measurement base for bounce and complaint rates, used instead of a fixed window so a small sender's bad day doesn't trip a pause and a large sender's bad hour does (Inbox Rules).
• RespOrg (responsible organization): the entity a toll-free subscriber chooses to manage its records in the toll-free registry (47 CFR 52.101) (Phone Numbers & Porting).
• RMD (Robocall Mitigation Database): the FCC's public list of voice providers, each with a STIR/SHAKEN certification and a robocall mitigation plan; listing is the license to send traffic onto the US network (Voice Platforms).
• Robocall mitigation plan: the filing in the RMD describing how a provider knows its customers and avoids carrying illegal robocalls, updated within ten business days of a change and recertified yearly (Voice Platforms).
• Segment: the billing and throughput unit of SMS: a long message or one containing a non-GSM character is several segments, counted at accept time and billed per segment (Sending a Text).
• SES sandbox: the per-Region starting state of an Amazon SES account, sending only to verified addresses or the mailbox simulator at a low cap until production access is granted (Email Sending Platforms).
• SES tenants: an SES feature that divides one AWS account's sending into tenants with automated reputation policies (Standard, Strict or None) that pause sending on findings (Email Sending Platforms).
• Short code: a five- or six-digit number leased from the Common Short Code Administration, with the highest throughput and recognition and the longest certification (Business Texting Registration).
• SIP trunking: voice service in which a customer's phone system or application sends and receives calls over SIP to the provider, with media (RTP) flowing separately, billed per minute, channel or trunk and number (Voice Platforms).
• SMS pumping (artificially inflated traffic, AIT): bots abusing any form that texts a typed phone number, triggering passcodes to blocks of numbers on a carrier that shares the termination revenue (Telecom Fraud).
• SNDS: Microsoft's sender data program for IP reputation, which includes the Junk Email Reporting Program (Inbox Rules).
• Soft bounce: a temporary delivery problem (mailbox full, server busy, a 4yz deferral), retried with backoff and suppressed only after repeated failures (Email Sending Platforms).
• Software aggregator: a CPaaS that is a routing and orchestration layer over owned-network providers and aggregators, fastest to build with the thinnest margin and the most upstream risk (The CPaaS Business).
• Sole Proprietor brand: a 10DLC brand type for individuals with no tax ID, limited to one campaign and the lowest throughput (Business Texting Registration).
• Solution Partner (WhatsApp): a Meta partner that onboards businesses with its own credit line and invoices them for Meta's fees, carrying their credit risk; often called a BSP (WhatsApp & Messaging Apps).
• SPC token: the token from the STI Policy Administrator (iConectiv) that proves a provider is authorized to get STIR/SHAKEN certificates (Voice Platforms).
• Special-services blocks: default blocks on premium-rate and shared-cost destinations, part of the platform's defense against toll fraud (Telecom Fraud).
• Spend and concurrency limits: caps on simultaneous international calls and hourly international spend per account, with alerts, modeled as quotas (Telecom Fraud).
• START keyword: the inbound keyword (or the campaign's opt-in keyword) that lifts the platform's opt-out for that recipient and sender (Sending a Text).
• STIR/SHAKEN: caller ID authentication: STIR (the IETF's Secure Telephone Identity Revisited) defines the cryptography and SHAKEN (ATIS-1000074) how US carriers use it to sign and verify calls (Voice Platforms).
• STOP keyword: the inbound keyword that records an opt-out for that recipient against that sender, sends the campaign's confirmation and rejects later sends with a permanent error (Sending a Text).
• Stream- and tenant-level thresholds: pausing only the stream or tenant that caused a reputation problem, keeping transactional mail flowing at the cost of more state (Inbox Rules).
• Suppression: a recorded refusal to send to an address (after a hard bounce, complaint or unsubscribe), scoped to platform, account, tenant or stream and honored whatever the API call says (Email Sending Platforms).
• Tech Provider (WhatsApp): a Meta partner that onboards businesses without a credit line, so Meta bills each business directly and the partner bills only its own fee (WhatsApp & Messaging Apps).
• Template recategorization: Meta changing an approved template's category after review; since April 9, 2025 a utility template it judges promotional is approved as marketing, with notice and 60 days to appeal (WhatsApp & Messaging Apps).
• Termination (voice): outbound calls the customer's system sends to the provider as SIP INVITEs, which the provider routes to the destination network (Voice Platforms).
• Throughput scopes: the separate limits a text must clear (campaign on AT&T, brand on T-Mobile, MMS per carrier, toll-free number, upstream route, account), each in its own unit (Sending a Text).
• Toll fraud: running up calls on a customer's account to expensive destinations, usually through an open SIP trunk or a stolen key; an open trunk is an open wallet (Telecom Fraud).
• Toll-free verification: the review a toll-free number must pass before it can text at volume, which now requires a business registration number and privacy policy and terms URLs (Business Texting Registration).
• Trust score (vetting score): the score a brand earns from vetting, from which carriers derive its throughput caps (Business Texting Registration).
• UCS-2: the SMS encoding used when any character falls outside the GSM alphabet, including one emoji, cutting a segment to 70 characters (67 when concatenated) (Sending a Text).
• Universal Service Fund (USF): the federal fund for rural, low-income, schools and libraries, and rural health care programs, paid for by provider contributions on interstate and international end-user revenue (911, CPNI & Telecom Duties).
• Verified caller ID: the record of a customer proving control of an outside number, by a verification call or text, before it may present that number as caller ID (Voice Platforms).
• VMC (Verified Mark Certificate): the BIMI certificate type that requires a registered trademark and earns Gmail's verified checkmark (Inbox Rules).
• VoIP direct access: numbering resources obtained by an interconnected VoIP provider directly from NANPA and the Pooling Administrator, subject to certifications (Phone Numbers & Porting).
• Warmup: gradually raising a new IP's volume so mailbox providers learn to trust it, with overflow to a reputable pool rather than delaying the customer's mail; state, not configuration (Email Sending Platforms).
• WhatsApp Business Account (WABA): the account under a business portfolio that holds a business's templates and phone numbers (WhatsApp & Messaging Apps).

Metering and Billing#

• Affected ratio: an SLA measure that weights an outage's minutes by the share of unique visitor IPs affected, so a partial outage earns a partial credit (SLAs & Service Credits).
• Alert-first provider: a provider that gives cost data and budget warnings but leaves stopping spend to the customer's own automation (Cost Data, FinOps & Surprise Bills).
• Allowance: a quantity a subscription includes (requests, CPU-hours, rows read), held on the plan version and consumed during rating before anything is priced; not a credit (Metering & Rating).
• Always free: a monthly allowance per meter that resets each period, in effect a negative price on the first units of a meter, every month, forever (Free Tiers, Credits & Startup Programs).
• Anomaly detection (cost): flagging spend that departs from an account's pattern; actionable only if it names the project, SKU or region that changed, and worth most when it runs on provisional hourly rating (Cost Data, FinOps & Surprise Bills).
• Attributes (SKU): the descriptive properties of a SKU for humans and tools (vCPUs, memory, storage class, operating system, tenancy), as distinct from the SKU code that billing points at (Pricing Catalogs).
• Automatic non-billing: an SLA remedy that simply doesn't charge for unavailable hours, with no claim needed, applied as a correction during rating rather than as a credit (SLAs & Service Credits).
• Automatic renewal law (state): state statutes on auto-renewing consumer contracts, such as California's, with their own disclosure, reminder and cancellation rules, versioned as rule rows by jurisdiction and consent date (Subscriptions, Renewals & Cancellation Law).
• Bill pipeline: the ordered stages from usage events to invoice (rating, allowances, commitments, credits, tax, rounding), in which discounts never edit rated usage and nothing is rounded before the invoice line (Metering & Rating).
• Billing mode: a contract fact on the account deciding how it pays: self_serve charged automatically, invoiced with net terms, or billed_by_parent through a reseller or organization (Invoices, Dunning & Suspension).
• Breakage: the value of credits that expire unused, computed and reported to finance by cohort rather than posted by the product; the order credits expire in changes it (Free Tiers, Credits & Startup Programs).
• Budget: an amount, a scope, a period, a cost basis, thresholds that alert and optionally an action; providers word budgets as alerts and customers often read them as limits (Cost Data, FinOps & Surprise Bills).
• Budget actions: AWS's mechanism that applies a policy or stops resources when a budget threshold is crossed, opt-in and customer-configured (Cost Data, FinOps & Surprise Bills).
• Capacity minutes: an SLA measure for capacity reservations counting minutes a reserved unit can't be allocated after a supported deployment (SLAs & Service Credits).
• Capped price: a price shape that is flat until a period ceiling per resource, such as a monthly cap on an hourly server price (Pricing Catalogs).
• Cascade (reseller): applying a non-paying reseller's hold to its sub-accounts' resources, at once for no_new_resources and only after notice for stronger effects (Invoices, Dunning & Suspension).
• Charge date as cancellation deadline: the rule that a renewal reminder must arrive before the card is charged, not before expiry, because the charge is the last moment the customer can stop it (Subscriptions, Renewals & Cancellation Law).
• charge_lead_days: the plan version column that makes an early renewal charge explicit and anchors reminders and invoice runs on the charge rather than the expiry (Subscriptions, Renewals & Cancellation Law).
• Click-to-cancel: the FTC's 2024 amendments to the Negative Option Rule that would have made a federal cancellation standard, vacated by the Eighth Circuit in July 2025; the FTC restored the 1973 text in 2026 (Subscriptions, Renewals & Cancellation Law).
• Commitment drawdown (marketplace): the selling point of cloud marketplaces: a customer with an unmet spend commitment buys a vendor's software and retires commitment at the same time (Commitments, Discounts & Marketplaces).
• Committed use discount (CUD): Google's commitment discount, spend-based (an hourly dollar amount across projects the billing account pays for) or resource-based (bought for a project) (Commitments, Discounts & Marketplaces).
• Connectivity minutes: an SLA measure counting minutes a resource has no external connectivity (for multi-zone commitments, every instance in two or more zones at once) (SLAs & Service Credits).
• Consumed Quantity and Pricing Quantity: the FOCUS split between what a meter measured and the unit the price applies to, which is where minimums, increments and package sizes show (Cost Data, FinOps & Surprise Bills).
• Contracting entity versus billing entity: the split in which one legal entity is party to the terms and disputes while another numbers invoices and charges tax (Tax on Hosting & Cloud).
• Correction (usage): a new event that restates a wrong one through corrects_id, carrying the full corrected quantity (zero to void), never an update or a subtraction (Metering & Rating).
• Cost export: the provider's rated usage, discounts, credits, taxes and fees as one row per charge, delivered on a schedule to the customer's storage and restated as rating changes (Cost Data, FinOps & Surprise Bills).
• Counter (meter kind): a meter of how many times something happened (requests, rows read, segments, tokens), aggregated by sum (Metering & Rating).
• Credit balance with expiry: a free offer bounded by an amount and a clock, easy to void and booked as a liability with breakage (Free Tiers, Credits & Startup Programs).
• Credit exhaustion cap: a spend cap where nothing else can be billed by construction, because the account has no payment method or can't be charged once credit runs out (Cost Data, FinOps & Surprise Bills).
• Credit tier (SLA): the percentage of the affected service's fee credited for a period, chosen by the lowest tier the measured uptime falls below (SLAs & Service Credits).
• credit_grants: the table of credits issued to an account (promotional, startup, SLA, goodwill, commitment shortfall), each with its amount, scope, exclusions and expiry, drawn down by invoice lines (Free Tiers, Credits & Startup Programs).
• CUR (Cost and Usage Report): AWS's native line-item cost export, carrying every provider-specific column, as opposed to the cross-provider FOCUS format (Cost Data, FinOps & Surprise Bills).
• Cycle invoice: the regular invoice for usage in arrears for the period plus recurring charges in advance where the plan bills that way, issued on the cycle date (Invoices, Dunning & Suspension).
• Data after termination: the window after an account ends during which content is retained and retrievable, published by each provider and sometimes conditioned on payment (Invoices, Dunning & Suspension).
• Digital services tax: a tax aimed at platforms, advertising and marketplaces rather than infrastructure rent, different from withholding tax on cloud payments (Tax on Hosting & Cloud).
• Dimensions (meter): the attributes on a usage event (region, operating system, carrier, direction, storage class, model, outcome) that split one meter into many prices and decide the SKU (Metering & Rating).
• Dispute (invoice): a record against invoice lines that pauses interest and dunning for those lines only, setting a dunning case to paused rather than closing it (Invoices, Dunning & Suspension).
• Dunning: the schedule of payment retries, notices and grace after a failed payment, stored as rows with offsets per billing mode and escalating by adding stronger holds (Invoices, Dunning & Suspension).
• Duration (meter kind): a meter of how long something existed or ran (instance-seconds, GPU-hours, address-hours), aggregated as the overlap of each lifetime with the window (Metering & Rating).
• Effective events: the usage events rated for a window: those in it, received before the run's cutoff and not superseded by a later correction (Metering & Rating).
• Electronically supplied service (EU VAT): a service on the EU's Implementing Regulation 282/2011 Annex I list, which includes website and webpage hosting, taxed where a consumer is (Tax on Hosting & Cloud).
• Error-rate intervals: an SLA measure averaging server errors over requests in each five-minute interval of the month, with empty intervals at 0% (SLAs & Service Credits).
• Error-rate threshold: an SLA measure that counts minutes only when more than a set share of valid requests fail for consecutive minutes with the client backing off (SLAs & Service Credits).
• ERRP clock (domains): the pre-expiry and post-expiry notices ICANN's Expired Registration Recovery Policy requires, generated as a second rule set beside consumer renewal rules on the same subscription (Subscriptions, Renewals & Cancellation Law).
• Exemption certificate: a customer's tax exemption document, held with its expiry and review status and checked at invoicing (Tax on Hosting & Cloud).
• Flat price: the simplest price shape, quantity times unit price, used for instance-seconds, segments and most usage (Pricing Catalogs).
• FOCUS (FinOps Open Cost and Usage Specification): the FinOps Foundation's common cost export format with List Cost, Effective Cost and Billed Cost columns, readable across providers (Cost Data, FinOps & Surprise Bills).
• Forgiveness (surprise bill): choosing not to collect for usage that was real, recorded as a goodwill credit grant, as distinct from fixing a faulty meter by rerating (Cost Data, FinOps & Surprise Bills).
• Gauge (meter kind): a meter of a level held over time (stored GB, provisioned memory), aggregated as a time-weighted average and converted to GB-months or GB-hours (Metering & Rating).
• Graduated tiers: a price shape in which each volume band is priced at its own rate and the bands are summed (Metering & Rating).
• Gross-up: a contract clause under which a customer whose country withholds tax still owes the provider the full invoice amount, so a short payment equal to the withholding rate stays owed (Tax on Hosting & Cloud).
• Hard cap (spending limit): a limit that stops spend rather than alerting, implemented as an account hold when provisional spend reaches the limit; sold as hard, any overshoot is credited (Free Tiers, Credits & Startup Programs).
• Hourly spend commitment: a dollar-per-hour promise for a term (AWS Savings Plans, Azure savings plans, Google spend-based CUDs), in which each hour's eligible usage is priced at commitment rates and unused commitment is lost (Commitments, Discounts & Marketplaces).
• Idempotency key (usage event): the producer's key on every event, unique per source, so a replayed batch inserts nothing and duplicates are a no-op (Metering & Rating).
• Invoice run: a batch job with a period, a cutoff and a seller that turns rated usage, commitments and credits into numbered, taxed invoices for every account, idempotent and resumable (Invoices, Dunning & Suspension).
• Invoiced net terms: billing large accounts by invoice payable within a contractual period, with receivables, late payers and collections, instead of charging a card (Invoices, Dunning & Suspension).
• Involuntary churn: customers lost to failed payment rather than cancellation, reported as its own metric because its fix is billing, not product (Invoices, Dunning & Suspension).
• Late interest: a contractual rate and trigger for overdue invoices, charged as an adjustment line on a later invoice and never as a change to the late one (Invoices, Dunning & Suspension).
• Lateness window: how late a usage event may arrive and still rate into its own period, stated per meter (meters.lateness_window); events after the cutoff go to the next run as adjustments (Metering & Rating).
• Lease tax (Chicago): Chicago's Lease Transaction Tax, which the City's Ruling #12 applied to charges under a "non-possessory computer lease", reaching cloud compute; an effective-dated rate the City changes with its budgets (Tax on Hosting & Cloud).
• List, Effective and Billed Cost: the three costs per cost-export row: what usage would cost at list, what it cost with commitment purchases amortized, and what the customer is billed (Cost Data, FinOps & Surprise Bills).
• Listing fee: a cloud marketplace's share of a vendor's sale, set by offer type and contract value and frozen at acceptance; the provider's revenue is the fee, not the line (Commitments, Discounts & Marketplaces).
• MACC (Microsoft Azure Consumption Commitment): a contractual commitment to a level of Azure spending over a period, tracked by remaining balance and eligible spend, with statuses Active, Complete, Expired and Canceled (Commitments, Discounts & Marketplaces).
• Marketplace (cloud): a provider's catalog of third-party software billed on the provider's invoice, where the vendor's charge is a pass-through line and eligible purchases count toward commitments (Commitments, Discounts & Marketplaces).
• Merchant of record: a third party that sells on a provider's behalf and takes on the registrations and filings, for a fee per transaction (Tax on Hosting & Cloud).
• Meter: a named measurement with a unit, a way of aggregating it and the dimensions that can split it; a SKU rates a meter, and several SKUs can rate the same one (Metering & Rating).
• Meter registry: the contract between service teams and billing: a new meter is a row with an owner, kind, allowed dimensions and lateness window before any event may name it (Metering & Rating).
• Milestone (commitment): an optional intermediate spend target with a due date and amount inside an enterprise commitment, whose miss can trigger a shortfall (Commitments, Discounts & Marketplaces).
• Minimum and increment: the per-session billing rules (a one-minute minimum, per-second or per-minute rounding) a SKU applies, charged once per launch or job rather than per hour (Metering & Rating).
• Monthly cap: a ceiling at which an hourly charge stops for the month, such as a server never billed above its monthly price (Metering & Rating).
• Negative Option Rule: the FTC's 1973 rule on prenotification plans, the book-club model, which the FTC's later amendments sought to extend to all negative option offers (Subscriptions, Renewals & Cancellation Law).
• No setoff: the contract rule that a customer pays the invoice in full even if it believes it is owed an SLA credit, which arrives separately through the SLA process (Invoices, Dunning & Suspension).
• Notice (price change): the record of when a price change was announced, through which channels and to which affected accounts, enforced so an effective date before the required notice can't be inserted (Pricing Catalogs).
• One Stop Shop (OSS): the EU scheme, since July 2021, letting a seller file one quarterly VAT return for consumer sales across all member states (Tax on Hosting & Cloud).
• Package price: a price shape charged per block with partial blocks rounded up, such as traffic overage in fixed blocks or credit packs (Pricing Catalogs).
• Partial invoice (threshold): an invoice issued mid-cycle when accrued usage crosses the account's threshold; partial and end-of-cycle invoices must add up to the period without double billing (Invoices, Dunning & Suspension).
• Pass-through fee: a supplier's charge (carrier, registry, regulatory, marketplace vendor) billed on its own SKU and rated as a separate row from the same event, so it never blends into the provider's margin (Metering & Rating).
• Period-close run: the authoritative rating run for a period that rerates all effective events with tiers, caps and allowances applied over the whole period, superseding the provisional hourly runs (Metering & Rating).
• Price book: a set of price versions (list, a contract, a commitment's rates); rating looks in the account's contract book first, then list (Pricing Catalogs).
• Price version: an effective-dated price for a SKU in a price book and currency, with its tier shape; a price change is a new version with an announcement, boundary, audience and notice obligation (Pricing Catalogs).
• Pricing page as truth: the rule that the page, API, calculator, checkout and rater all render the same price rows, because the published page wins every dispute (Pricing Catalogs).
• Private offer: a negotiated marketplace price and contract terms for one buyer, sometimes through a channel partner who records its own margin (Commitments, Discounts & Marketplaces).
• Proportional credit: an SLA remedy that matches the credit to the measured damage, allowing a headline 100% promise that pays little (SLAs & Service Credits).
• rated_usage: the rating output per run: billable quantity after minimums, the part an allowance covered, and the unrounded amount, which commitments and credits point at rather than edit (Metering & Rating).
• Rating: the deterministic function that turns the effective events for a window, the SKUs that match them and the price versions in force when usage happened into money, written to rated_usage unrounded (Metering & Rating).
• Renewal price: the list price a plan renews at after its intro term, a material term to disclose before billing, often several times the intro price (Subscriptions, Renewals & Cancellation Law).
• Rerating: fixing a price, a rule or a batch of events by a new rating run that supersedes the old one for its scope, with the diff as the evidence for a disputed bill (Metering & Rating).
• Reserved Instance: a commitment to a specific resource (instance type, region) for a term in exchange for a discount, applied before savings plans (Commitments, Discounts & Marketplaces).
• Reverse charge: the B2B VAT rule under which the business customer, not the seller, accounts for VAT on a cross-border service (Article 196 of the VAT Directive) (Tax on Hosting & Cloud).
• ROSCA (Restore Online Shoppers' Confidence Act): the US federal law (15 U.S.C. 8403) requiring clear disclosure of material terms before billing information is collected, express informed consent and simple mechanisms to stop recurring charges (Subscriptions, Renewals & Cancellation Law).
• Savings Plans: AWS's dollar-per-hour commitment for one or three years, as Compute Savings Plans across families, Regions and services or EC2 Instance Savings Plans for one family in one Region (Commitments, Discounts & Marketplaces).
• Seller entity (seller of record): the legal entity that sells to an account and whose registrations, invoice series and tax rules apply, assigned from address data and changeable only for future invoices (Tax on Hosting & Cloud).
• Service-level cap: a spend cap that stops new usage of one service in one project while in-flight requests and persistent resources continue (Cost Data, FinOps & Surprise Bills).
• Shortfall charge: the amount owed when an enterprise spend commitment or milestone isn't met, recorded as an invoice line and a credit grant of kind commitment_shortfall (Commitments, Discounts & Marketplaces).
• SKU: one billable unit with one meter, such as one instance type in one region on one operating system per second; its code is permanent and a discontinued SKU is retired, never deleted (Pricing Catalogs).
• SLA (service level agreement): a price adjustment, not a promise of uptime: a published definition of uptime with credit tiers, exclusions and a claim process, usually the customer's sole remedy (SLAs & Service Credits).
• SLA versus SLO: the difference between the contractual measure a provider credits against and its internal objective; the error budget must use the published definition to predict credit exposure (SLAs & Service Credits).
• Sole remedy: the SLA clause making service credits the customer's only remedy for downtime, alongside exclusions for causes outside the provider's control, the customer's doing, previews, throttling, suspension and maintenance (SLAs & Service Credits).
• Spend commitment (total): a dollar total over a term, sometimes with milestones, that eligible invoiced spend decrements, in exchange for a discount on everything (Commitments, Discounts & Marketplaces).
• Spot capacity: the provider's idle buffer sold at a discount with a recall clause, interrupted with short or no notice when capacity is needed, recorded as the end of the resource's lifetime (Commitments, Discounts & Marketplaces).
• Startup program: a credit with a sponsor, often an investor whose identifier unlocks it, sized up to six figures, with exclusions enforced at application time (Free Tiers, Credits & Startup Programs).
• Stop-first provider: a provider or plan that pauses or stops usage at a limit (free plans, credit subscriptions, optional budget pauses) rather than only alerting (Cost Data, FinOps & Surprise Bills).
• Suspension clock: the published days from non-payment to suspension, termination and data deletion, stored on the account hold so notices quote the same dates the system enforces (Invoices, Dunning & Suspension).
• Sustained use discount: Google's automatic discount for running a resource much of the month, delivered as monthly credits and not applied to usage a commitment already covers (Commitments, Discounts & Marketplaces).
• Tax location: the basis recorded on each invoice for where the customer is (tax ID country, matching card, billing or contact address), chosen by a published precedence (Tax on Hosting & Cloud).
• Threshold billing: charging a new or risky account mid-cycle whenever accrued usage crosses a per-account threshold that rises with payment history; a threshold collects money and is not a spend cap (Invoices, Dunning & Suspension).
• Trial: full or restricted access for a period, a clock that ends in a decision; a trial that converts to paid without a new act is an automatic renewal under state law (Free Tiers, Credits & Startup Programs).
• Turn off auto-renew: the toggle many providers use to end a plan at term end, which is legally and in the data a cancellation (Subscriptions, Renewals & Cancellation Law).
• Unavailable minutes with a floor: an SLA measure that counts API unavailability only in outages longer than a minimum continuous duration (SLAs & Service Credits).
• Usage time: the time usage happened, which picks the price version, as opposed to processing time, so a rerun next quarter prices the same way (Metering & Rating).
• USF recovery line: the provider's recovery of its Universal Service contribution, billed as a regulatory pass-through SKU on the interstate share of revenue rather than as a tax line (Tax on Hosting & Cloud).
• VAT ID validation: checking a customer's VAT number, the trigger for reverse charge, with a pending or unverifiable state when the validation service doesn't answer (Tax on Hosting & Cloud).
• Volume tiers: a price shape in which the whole quantity takes the rate of the band it ends in (Metering & Rating).
• Withdrawal right: the consumer right to withdraw from a distance contract within a set period, which a provider starting service at once must handle inside a prepaid term (Subscriptions, Renewals & Cancellation Law).
• Withholding tax: tax a customer's country deducts from a cross-border payment to the provider, which a provider can avoid with a local entity or offset by grossing up (Tax on Hosting & Cloud).

Abuse, Trust and the Law#

• 50 Percent Rule: OFAC's rule that an entity owned 50 percent or more by blocked persons is itself blocked; control without that ownership doesn't block an entity automatically (Sanctions, Exports & Bulletproof Hosts).
• 512(a) transitory communications: the DMCA safe harbor for a conduit that carries transmissions initiated by others through an automatic technical process, with no notice-and-takedown duty because it has nothing to take down (Conduits, Caches & Blocking Orders).
• 512(b) system caching: the DMCA safe harbor for a cache that doesn't modify the material and follows the originating site's rules, removing cached copies once the origin has removed them or a court has ordered it (Conduits, Caches & Blocking Orders).
• 512(j) injunctions: the DMCA provision that lets a court enjoin an intermediary even inside a safe harbor, the route to blocking a conduit (Conduits, Caches & Blocking Orders).
• Acceptable use policy (AUP): the contract term every abuse action rests on, listing illegal content, infringement, security violations, network abuse and abuse of the provider, with a remedy clause; kept as versioned data (Abuse on Infrastructure).
• Account linking: connecting accounts through shared signals (payment fingerprint, device, phone, IP range, SSH key) so a fraud ring is acted on at once; each link is evidence with a strength, not a verdict (Free-Tier Fraud & Stolen Keys).
• AI Diffusion Rule: the BIS export rule on AI chips and model weights that was rescinded before it took effect in May 2025 (Sanctions, Exports & Bulletproof Hosts).
• Article 5n: the provision of EU Council Regulation 833/2014 barring listed services (IT consultancy, then enterprise-management and design software, including cloud delivery and updates) to the Russian government and entities established in Russia (Sanctions, Exports & Bulletproof Hosts).
• Block BEARD Act: a US Senate discussion draft of July 2025 that would let courts order blocking of foreign piracy sites by intermediaries (Conduits, Caches & Blocking Orders).
• Blocking order: a court or regulator order requiring an intermediary to stop resolving, proxying or serving named domains or IPs in a territory, modeled as a legal notice with its clock and status (Conduits, Caches & Blocking Orders).
• Bulletproof host: a provider whose product is non-enforcement; when designated, such hosts tend to rebrand and move infrastructure to new companies in other countries (Sanctions, Exports & Bulletproof Hosts).
• Containment (fraud): limiting what a new or compromised account can do, through risk quotas on GPUs, mail and egress, the third of four responses to free-tier abuse (Free-Tier Fraud & Stolen Keys).
• Continuous screening: rescreening every account against each sanctions list update and on changes to account data, catching new designations within a day (Sanctions, Exports & Bulletproof Hosts).
• Core services (abuse tier): authoritative DNS, public resolvers, registries, registrars and transit, where the possible actions (remove records, hold, refuse resolution, null-route) reach far beyond one customer and must be narrow (Abuse on Infrastructure).
• Cox v. Sony: the 2026 US Supreme Court decision that a conduit receiving infringement notices and continuing to serve a customer isn't contributorily liable for that alone (Conduits, Caches & Blocking Orders).
• Cryptomining (abuse): the dominant use of stolen and free compute, because it needs only cycles and pays immediately; containment has to be automatic because a human response is too slow (Free-Tier Fraud & Stolen Keys).
• Dynamic blocking order: a blocking order whose target list grows as rights holders report new domains and IPs, each new target carrying its own compliance clock (Conduits, Caches & Blocking Orders).
• FADPA (Foreign Anti-Digital Piracy Act): H.R. 791, introduced in January 2025 to allow site-blocking orders against intermediaries, including large DNS resolvers, with no action after referral (Conduits, Caches & Blocking Orders).
• Free-tier farming: opening many accounts to collect a free tier's allowances or credits; the quotas a new account gets are the real limit, so they belong to the risk system (Free-Tier Fraud & Stolen Keys).
• General License D-2: OFAC's license authorizing services, software and hardware incident to communications for people in Iran, which lets consumer communications and their cloud services reach them (Sanctions, Exports & Bulletproof Hosts).
• Geoblock on the proxy: refusing listed hostnames to requests from the ordering country, with a 451, the narrowest compliance with a blocking order (Conduits, Caches & Blocking Orders).
• Hosted services (abuse tier): shared hosting, VMs, object storage, static sites and managed databases, where the provider holds the content and can remove or quarantine it, suspend or terminate (Abuse on Infrastructure).
• IaaS customer identification rule: the BIS rule proposed in January 2024 under Executive Order 13984 to make US IaaS providers verify foreign customers; listed as withdrawn in December 2025, with no final rule as of October 2026 (Sanctions, Exports & Bulletproof Hosts).
• LLMjacking: using stolen cloud credentials to run hosted AI models at the victim's expense, named in Sysdig's 2024 report (Free-Tier Fraud & Stolen Keys).
• Mere conduit: the liability category for pure transmission (exchange points, access points, VPNs, DNS services and resolvers among the DSA's Recital 29 examples), which carries no duty to remove content (Abuse on Infrastructure).
• Nondisclosure order: a court order under 18 U.S.C. 2705(b) forbidding a provider to tell its customer about a request, which the provider must decide whether to challenge (Law Enforcement at Infrastructure Providers).
• OFAC (Office of Foreign Assets Control): the US Treasury office whose programs prohibit US persons from serving blocked persons on the SDN list and, under comprehensive embargoes, anyone in the embargoed region, unless licensed (Sanctions, Exports & Bulletproof Hosts).
• Own-initiative detection: scanning hosted content for known-bad hashes and phishing kits and watching compute for mining and scanning patterns, finding abuse before anyone reports it (Abuse on Infrastructure).
• Pass-through services (abuse tier): CDN, reverse proxy, WAF, DDoS protection and load balancing in front of a customer origin, which can show an interstitial, stop caching or stop proxying but can't remove the content (Abuse on Infrastructure).
• Piracy Shield: Italy's AGCOM platform under its 2023 anti-piracy law, through which rights holders report domains and IPs that intermediaries must block within 30 minutes (Conduits, Caches & Blocking Orders).
• Preservation (infrastructure): a snapshot of the named volumes and buckets into a restricted store under a legal hold, kept for the statutory period and released if no process follows, without changing the customer's resources (Law Enforcement at Infrastructure Providers).
• Quarantine policy (stolen key): a managed deny policy attached to an exposed credential that blocks launching compute, creating persistence and similar actions while legitimate reads keep working; modeled as a permission ceiling (Free-Tier Fraud & Stolen Keys).
• Redirection to the customer: asking the government to serve an enterprise customer directly rather than producing its data, a disposition only an infrastructure provider has, counted separately in transparency reports (Law Enforcement at Infrastructure Providers).
• Related-account fan-out: acting on every account linked to a confirmed fraud ring at once, with the link strength recorded (Abuse on Infrastructure).
• Resolving the identifier: turning an IP, hostname or timestamp in a request into the account that held it at that instant, minding time zones, shared addresses, pass-through services, resellers and deleted resources (Law Enforcement at Infrastructure Providers).
• Risk quotas: small limits for new and unverified accounts, especially on GPUs and mail, that cap the damage any one account can do (Free-Tier Fraud & Stolen Keys).
• SDN list (Specially Designated Nationals): OFAC's list of blocked persons that a provider screens owners and end customers against, naming the list version each screening used (Sanctions, Exports & Bulletproof Hosts).
• Secret scanning partnership: a code host's program in which token issuers register their token formats and an endpoint, so leaked credentials found in public code are reported to the issuer automatically (Free-Tier Fraud & Stolen Keys).
• Stored Communications Act ladder: the US framework of subpoena, court order and warrant for successively more sensitive records, with preservation, emergency disclosure and nondisclosure orders around it (Law Enforcement at Infrastructure Providers).
• Structured intake: reports from trusted reporters, blocklists and scanners arriving as structured feeds, so a match to a known phishing kit or malware hash can be actioned without a reviewer (Abuse on Infrastructure).
• Three tiers of service: the split of infrastructure into hosted, pass-through and core services, each with different possible actions, recorded on the resource because one account can hold all three (Abuse on Infrastructure).
• Tiered policy: acting on content only where the provider hosts it, acting on pass-through for law, safety and abuse of the provider, and resisting global blocks on core services (Abuse on Infrastructure).
• Voluntary termination: a provider ending service to a customer on its own judgment rather than under law or a report, rare and recorded with its reason as an exception to the ladder (Abuse on Infrastructure).

Market Rules and Compliance#

• Attestation of Compliance (PCI): the PCI DSS document a Qualified Security Assessor issues for a service provider's part in protecting cardholder data (Shared Responsibility & Compliance Programs).
• attestation_scopes: the rows recording which services in which regions each compliance program covers over which period, so a trust portal, a sales answer and a responsibility matrix all agree and gaps are a query (Shared Responsibility & Compliance Programs).
• Bridge letter: a provider's letter covering the gap between the end of an audit report's period and the next report, because customers' audit periods don't line up with the provider's (Shared Responsibility & Compliance Programs).
• Bring your own license (BYOL): the customer supplying its own software licenses with mobility rights to run on a provider, subject to licensor restrictions such as Listed Provider terms (Licensing Disputes).
• CISPE settlement: the July 2024 agreement in which the European cloud trade group withdrew its competition complaint over Microsoft's licensing in exchange for a product for European hosters, monitored by ECCO (Licensing Disputes).
• CLOUD Act: the US law letting authorities compel a US provider to produce data in its possession, custody or control wherever it is stored, the concern sovereign cloud structures answer (Shared Responsibility & Compliance Programs).
• CMA cloud market investigation: the UK Competition and Markets Authority's investigation, referred by Ofcom, whose 2025 final decision found an adverse effect on competition from egress fees, software licensing and committed spend (Competition Cases).
• Complementary user entity controls: the controls a provider's audit report says its customers must operate for the provider's controls to achieve their objectives, the "in the cloud" half of shared responsibility written into the audit (Shared Responsibility & Compliance Programs).
• Conduct regime designation: a regulator designating a firm for standing, tailored obligations, such as UK strategic market status or an EU DMA gatekeeper (Competition Cases).
• DMA gatekeeper designation: the European Commission's Digital Markets Act investigations, opened in November 2025, into designating AWS and Azure as gatekeepers for cloud below the quantitative thresholds (Competition Cases).
• ECCO (European Cloud Competition Observatory): the monitor that tracked Microsoft's delivery under the CISPE settlement with traffic-light ratings (Licensing Disputes).
• Egress fee: the charge for data leaving a provider's network, the main switching cost that regulators targeted and that providers price as metered, bundled per server or zero (Egress & Switching).
• EU Data Act switching rules: Chapter VI of Regulation (EU) 2023/2854, in force from September 2025, setting a two-month maximum notice to switch, transitional and retrieval periods, the phase-out of switching charges and interoperability duties (Egress & Switching).
• Exit waiver: free data transfer out for a customer leaving a provider, granted on request and usually as credits after approval, offered by the three hyperscalers from 2024 (Egress & Switching).
• FedRAMP: the US authorization program for federal agencies' use of cloud services, run under Rev5 with agency sponsors or the newer 20x process (Shared Responsibility & Compliance Programs).
• FedRAMP 20x: FedRAMP's newer authorization process, piloted in phases and offered in classes by impact level, which a provider starting today should plan on instead of Rev5 (Shared Responsibility & Compliance Programs).
• GovRAMP: the non-profit verification program for state and local governments, formerly StateRAMP, the state and local counterpart to FedRAMP (Shared Responsibility & Compliance Programs).
• ISO/IEC 27001: the certification of an information security management system against the standard, with 27017 and 27018 adding cloud and personal-data controls (Shared Responsibility & Compliance Programs).
• License Mobility: Microsoft's Software Assurance right to bring licenses to any provider, as distinct from licenses without mobility rights, which can't be deployed on Listed Providers (Licensing Disputes).
• License-included SKU: a provider-supplied software license sold as a pass-through SKU with its own price versions, so a licensor's price change is a new version with notice (Licensing Disputes).
• Listed Providers: the clouds (Microsoft, Alibaba, Amazon and Google) on which Microsoft's outsourcing terms restrict deploying licenses that lack mobility rights; any other provider is an Authorized Outsourcer (Licensing Disputes).
• Multicloud transfer at cost: discounted or zero-charge transfer for traffic a customer designates between a provider and another cloud while using both, offered by Google and Azure in 2025 to meet the Data Act (Egress & Switching).
• PCI DSS Appendix A1: the additional PCI DSS requirements for multi-tenant service providers, part of what a host's responsibility matrix covers (Shared Responsibility & Compliance Programs).
• Responsibility matrix: for each requirement of a framework such as PCI DSS, whether the provider, the customer or both are responsible, per service; the deliverable customers actually use (Shared Responsibility & Compliance Programs).
• Scope (attestation): what a compliance program certifies: named services in named regions over a named period, not a company; a service outside scope inherits nothing (Shared Responsibility & Compliance Programs).
• Shared responsibility model: the split in which the provider secures the cloud itself (hardware, software, networking, facilities) and the customer secures what it puts in the cloud; a contract boundary more than a security design (Shared Responsibility & Compliance Programs).
• SOC 2: an audit report on controls against the AICPA Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy), over a period (Type 2) or at a point in time (Type 1) (Shared Responsibility & Compliance Programs).
• Sovereign cloud: not an audit but a structure of legal entities, staff, locations and keys arranged so the provider's home government can't reach the data; a spectrum from data location to operational, key and legal control (Shared Responsibility & Compliance Programs).
• Strategic market status (SMS): the UK digital markets regime's designation that lets the CMA impose conduct requirements on a firm, the route it chose for Microsoft's cloud licensing (Competition Cases).
• Subservice organization: a provider a service relies on (a PaaS's hyperscaler) named in the audit report, whose controls are carved out or included (Shared Responsibility & Compliance Programs).
• Switching charges: charges for moving to another provider, which the EU Data Act allows only as reduced charges not exceeding the provider's costs until January 2027 (Egress & Switching).
• Trust Services Criteria: the AICPA criteria a SOC 2 report tests controls against, currently the 2017 criteria with revised points of focus (Shared Responsibility & Compliance Programs).
• VCSP (VMware Cloud Service Provider program): VMware's program for providers reselling VMware-based private cloud, which Broadcom phased out with its white-label model in the EEA from late 2025, replacing it with an invitation-only program (Licensing Disputes).
• VMware perpetual license end: Broadcom's December 2023 move ending perpetual VMware licenses and their support renewals in favor of subscriptions, which customers challenged in court (Licensing Disputes).
• Voluntary commitments (competition): steps firms design and offer instead of binding remedies, fast but not binding and dependent on review, as the CMA accepted in March 2026 (Competition Cases).

Running the Provider#

• account_id, resource_id, sku_id and time ranges: the four keys every provider join runs through: the paying tenant and its standing, the thing that ran, its price, and the periods (exists_during, held_during, valid_during) that tie records to instants (Provider Architecture).
• Annual revenue retention: the share of last year's revenue not lost to customers who left, the retention variant that isolates churn from expansion (Operating Metrics).
• ARR (annual recurring revenue): in this industry almost never a sum of contracts but a recent period's revenue annualized, so its definition is part of the number (Operating Metrics).
• Back-end (scale-out) fabric: the network that carries GPU-to-GPU traffic between servers, InfiniBand or RoCE, bundled into a cluster or placement construct rather than priced separately (GPU & AI Clouds).
• Batch pricing (AI APIs): discounted asynchronous processing on frontier model APIs, about half the standard price, which stacks with prompt caching (Where AI Runs: Home, Colo, Cloud or Frontier).
• Blast radius: the share of customers one failure can reach, bounded by design through regions, zones, cells and shuffle sharding rather than discovered in an outage (Provider Architecture).
• Break-even month: the month in a year-over-year model when cumulative savings from owning recover the up-front purchase (Total Cost of Ownership).
• Cached input: prompt tokens served from a model provider's cache at a fraction of the input price, one of the main levers on frontier API cost (Where AI Runs: Home, Colo, Cloud or Frontier).
• Capacity block (GPU): a fixed number of GPU instances for fixed dates, bought ahead at a price set at purchase, the way hyperscalers ration scarce large GPUs (GPU & AI Clouds).
• Capex versus cash view: owned hardware seen as straight-line depreciation over a useful life for the comparison, and as cash leaving at purchase (or financing payments) for whether the company can afford it (Total Cost of Ownership).
• Commissioned TCO study: a vendor-funded analysis, such as a Forrester Total Economic Impact study, that picks the composite customer, baseline and period; marketing, not a model of a workload (Total Cost of Ownership).
• Component status: the state of one product and region on a status page (Operational, Under Maintenance, Degraded Performance, Partial Outage, Major Outage), from which the top-level status is computed (Outages, Post-Mortems & Status Pages).
• Constant work: a reliability pattern in which a system does the same amount of work whatever happens, such as health checkers pushing every result every time, so load never spikes during failure (Provider Architecture).
• Control-plane dependency: a hidden dependency of a control plane on one building, another cloud, a database or the monitoring itself, the cause of several large outages (Outages, Post-Mortems & Status Pages).
• Cost per unit: cost of revenue divided by what was delivered (per VM-hour, GB-month, GB delivered, message, GPU-hour, million tokens), the number pricing should be set from (Operating Metrics).
• Downgrade to free: an account moving from paid to a free plan, counted separately from churn because the account still exists (Operating Metrics).
• Earning hours (GPU): the hours a GPU spends under paid use, its real utilization measure and what decides whether owning it beats renting (Operating Metrics).
• Front door: the control-plane layer that authenticates, authorizes, rate-limits and checks quota on every API call before anything is accepted (Provider Architecture).
• Front-end network (GPU): the network that carries everything except GPU-to-GPU traffic in an AI cluster: storage, checkpoints, the customer's other services and the internet (GPU & AI Clouds).
• Frontier API: a model lab's hosted API, where the customer owns nothing and pays per token (input, cached input, cache writes, output) under the lab's terms (Where AI Runs: Home, Colo, Cloud or Frontier).
• FTE fraction: a placement's recurring platform work in hours a month divided by productive hours, a stated and dated estimate rather than a fact (Total Cost of Ownership).
• Fully loaded cost: what an employee costs beyond salary; the chapter's public placeholder divides the BLS median systems administrator wage by the 70% wage share of compensation, about $141,600 a year (Total Cost of Ownership).
• Global-config failure pattern: the recurring outage shape: something that isn't code changes, propagates everywhere quickly by design, crashes a consumer that trusted it, and takes longer to recover from than to cause (Outages, Post-Mortems & Status Pages).
• Gross margin with pass-through: revenue less the cost of serving it over revenue, which pass-through fees lower without changing gross profit, so it is reported with and without them (Operating Metrics).
• Hosted open model: an inference provider serving an open-weight model the customer chooses, billed per token, with precision and speed varying by host (Where AI Runs: Home, Colo, Cloud or Frontier).
• Hosted status page: a SaaS status page product that models components, incidents and subscribers and runs on infrastructure independent of the provider's own (Outages, Post-Mortems & Status Pages).
• Incident lifecycle (status page): an incident's movement through Investigating, Identified, Monitoring and Resolved, with scheduled maintenance on its own lifecycle (Outages, Post-Mortems & Status Pages).
• Kinds of ending: the ways a product ends (free tier withdrawn, product shut down, version end of life, business sold, maintenance mode, location or endpoint moved), each owing customers something different (Migrations, Shutdowns & End of Life).
• Logo churn: customers active at the start of a period and not at its end, over customers at the start, meaningful only with the threshold that defines "active" written down (Operating Metrics).
• Magic Pocket: the storage system Dropbox built to move file content off Amazon S3 into its own infrastructure in colocation, the best-documented storage repatriation (Repatriation).
• Maintenance mode: a product kept running with fixes but no new features, which leaves customers to decide whether to stay (Migrations, Shutdowns & End of Life).
• Metering pipeline: the path from data-plane usage emission to rated usage, in which the data plane emits and never waits, every hop is idempotent and counts are reconciled against what is running (Provider Architecture).
• Multi-year take-or-pay: dedicated GPU capacity contracted for years, partly prepaid and paid whether used or not, the contract neoclouds finance their GPUs against (GPU & AI Clouds).
• Neocloud: a GPU-focused cloud provider that sells clusters on demand and under multi-year contracts, a utility financed like an infrastructure project with contracts as the collateral (GPU & AI Clouds).
• Net dollar retention: what last year's customers spend now, as a share of what they spent then; each provider computes it differently enough that the definition is part of the number (Operating Metrics).
• NVLink domain: the set of GPUs joined by NVLink and NVSwitch, the fastest network a model can use, inside one server or, in rack-scale systems such as GB200 NVL72, across a rack (GPU & AI Clouds).
• Off-bill costs: what no provider invoices: people and on-call, upgrade treadmills, observability and security tools, migration and exit, commitment risk, opportunity cost and depreciation (Total Cost of Ownership).
• On-call floor: the minimum rotation for 24-hour response, about eight engineers at one site or six per site across two, a headcount whatever the workload's size (Total Cost of Ownership).
• Operation (long-running): the record an API returns for anything slower than a few seconds, which the caller polls while the provisioning workflow runs (Provider Architecture).
• Opportunity cost (infrastructure): the product work an engineer doesn't do while running infrastructure, the reason small teams pay a managed service's premium (Total Cost of Ownership).
• Own the baseline, rent the burst: running steady load on owned hardware busy and keeping peaks and unknowns elastic in the cloud, at the cost of two platforms and the transfer between them (Repatriation).
• Owned annual cost: hardware over useful life plus colocation, network, support and spares, licenses, the change in staff and the cost of capital, compared with the rented side's effective rate and transfer costs (Repatriation).
• ownership_costs: effective-dated rows of off-bill cost per workload and scenario, on a monthly, FTE, one-time or capex basis, compared with the bill in one query (Total Cost of Ownership).
• Paid extended support: keeping old versions running for a fee before a forced upgrade, which turns a forced migration into a choice with a price (Migrations, Shutdowns & End of Life).
• People delta: the people a placement needs minus the people the company has regardless; zero when the existing team stays the same size, as 37signals reported (Total Cost of Ownership).
• Per-account status: status a provider computes for one customer's own resources and regions, telling each customer what is theirs where a public page can't (Outages, Post-Mortems & Status Pages).
• Per-output pricing: serverless model APIs charging per image, second of video or megapixel rather than per GPU-second (GPU & AI Clouds).
• Physalia: AWS's transactional key-value store for control-plane state, begun as the configuration master for EBS, highly available and strongly consistent by being available for only the keys each client needs (Provider Architecture).
• Post-mortem: a provider's public account of an incident, owed under published criteria, revised as understanding improves with both versions kept, and listing remediations as promises (Outages, Post-Mortems & Status Pages).
• Productive engineer-month: the 140 hours a month the chapter assumes an engineer spends on work after meetings and leave, the divisor for FTE fractions (Total Cost of Ownership).
• Provisioning: turning an accepted request into a running thing: authenticate, check standing and quota, accept idempotently, return an operation, place, run the workflow, converge and report (Provider Architecture).
• P/S/C (shared responsibility by task): marking each recurring task as absorbed by the provider, shared, or the customer's, per platform, the basis for counting people (Total Cost of Ownership).
• Reconciliation model: a provisioning style, made familiar by Kubernetes, that declares desired state and lets controllers converge current state toward it, instead of running an explicit workflow (Provider Architecture).
• Refresh (hardware): buying the fleet again at the end of its useful life, year six of a five-year model, which is why a five-year saving isn't permanent (Total Cost of Ownership).
• Renewal rate: the share of customers or names renewing at term end, reported by hosting and domain businesses and best broken out by term number for prepaid products (Operating Metrics).
• Repatriation: moving a workload from rented cloud capacity back to hardware the company owns or leases, usually in colocation, worth it when load is steady, the team exists and the cloud's discounts are already taken (Repatriation).
• Revenue churn: revenue lost from customers who left or shrank, over starting revenue, the complement of revenue retention (Operating Metrics).
• Router-level fallback: a model router trying models or providers in order and falling back on any error, billing at the model that served (Where AI Runs: Home, Colo, Cloud or Frontier).
• Serverless GPU: GPU compute billed per second or per output that scales to zero, with cold starts and a premium per hour at high utilization (GPU & AI Clouds).
• Sold versus installed: capacity allocated to customers over capacity installed, by zone and instance type, the utilization measure that drives capacity orders and spot pricing (Operating Metrics).
• Steadiness: typical load over peak load; the closer the median is to the peak, the busier an owned fleet runs and the better owning compares with renting (Repatriation).
• Sticker price: the provider's invoice alone, often the smallest term in a small workload's total cost (Total Cost of Ownership).
• Sunset lifecycle: the ordered end of a product: announce every date at once, close to new customers, stop changes, go read-only, shut down, then delete after a stated window (Migrations, Shutdowns & End of Life).
• Third-party components: status page components that mirror a vendor's own status page, so customers see when the failure is in the underlay (Outages, Post-Mortems & Status Pages).
• Total cost of ownership (TCO): everything a workload costs to run for a period: the bill plus people, upgrades, off-bill tools, migration and exit, commitments and, for owned hardware, depreciated capital (Total Cost of Ownership).
• Used versus sold: what allocated capacity actually does; the gap between it and sold capacity is the provider's overcommit margin and the noisy neighbor's risk (Operating Metrics).
• Useful life: the period owned hardware is depreciated over; five years is the default for general compute, and Amazon moved its servers from five to six years in 2024 and a subset back to five in 2025 (Total Cost of Ownership).
• Utilization of the owned fleet: average used capacity over capacity owned, the ratio that decides whether owning beats renting (Repatriation).
• Vendor risk: outages caused by a privileged agent's content push, a provider's own tooling, a building or a dependency of a dependency, rather than by the provider's own code (Outages, Post-Mortems & Status Pages).
• Workflow model: a provisioning style that runs an explicit sequence of steps with compensation on failure, recording each step's result so a crashed workflow resumes rather than restarts (Provider Architecture).

References#

Reference

• RFC 5730: Extensible Provisioning Protocol (EPP), the registry protocol behind the domain object, status and transfer terms
• RFC 8555: Automatic Certificate Management Environment (ACME), the issuance protocol behind the account, order, authorization and challenge terms
• ICANN: 2013 Registrar Accreditation Agreement (as amended, 21 January 2024), the registrar duties behind the domain lifecycle and registration data terms
• 17 U.S.C. 512, the DMCA safe harbors behind the conduit, caching and hosting terms
• Digital Services Act, Recital 29 (springlex mirror), the examples of mere conduit, caching and hosting infrastructure
• FOCUS specification, the cost export columns behind the FinOps terms